Signatures scoped to one object.
Machine-to-machine HMAC that can be bound to specific values — a particular record id, say — and carries its own expiry, so a signed service call is scoped to exactly the operation and object it was issued for.
1. A signature that means one thing
A general credential authorizes a class of actions; a scoped signature authorizes a single one. Service-HMAC binds the signed material to specific values — an operation and a target object such as a record id — so the resulting token is not a key to the API but a one-time pass for a single door. If it leaks, it grants exactly that operation on that object, and only until it expires.
2. Where it fits
Object-scoped signatures shine in delegated and capability-style flows: a service hands a downstream component the authority to act on one record without sharing a broad credential, or a short-lived signed URL grants a single fetch. The blast radius of a compromise collapses from “the integration” to “this object, for the next few minutes.”
3. How B5 Secure handles it
B5 Secure’s Service-HMAC lets a machine credential be bound to specific values with its own expiry, evaluated in the same verification pipeline as every other scheme. It is least privilege expressed at the level of a single signed request — the machine-to-machine complement to activity-data authorization.