Authentication Schemes

B5 Secure provides several authentication schemes so you can secure every integration scenario — from untrusted browser clients to server-to-server callbacks — under one consistent pipeline.

HMAC

The HMAC scheme signs each request with a keyed hash computed over the method, URL, headers and body. The server recomputes the signature and rejects any mismatch — so a tampered request fails the integrity check.

Expiration & replay prevention

HMAC tokens carry a timestamp and expire. Replayed or stale requests are rejected; even future-dated timestamps fail. This is what frustrates attackers replaying captured requests.

// signature binds method + path + body + timestamp
Authorization: "HMAC keyId:base64(signature):timestamp"

Service-HMAC

Service-HMAC is for machine-to-machine callbacks. You can embed specific values (such as a documentId) into the signed token, so a callback URL is valid only for the record it was issued for. Any change to that value fails the integrity check, and a configurable expiry renders old callbacks invalid.

AuthCookie

AuthCookie authenticates interactive browser sessions, with sensitive-key protection and the same pipeline checks applied to users as to machines.

Service-Key

Service-Key issues scoped keys for trusted server-to-server access, granting permits to only the endpoints an integration needs — nothing more.

Identity validation

During authentication, B5 Secure also applies:

• IP firewall — deny requests from outside an explicit allow-list (for sessions and keys alike).
• Origin restriction — tie a public key to designated domains; useful against phishing sites reusing your client keys.
• Sensitive-key protection — extra safeguards around high-privilege credentials.