eID · HMAC request signing
Builds the Authorization and X-TV-Timestamp headers for a call to eID, and verifies the signature on a response. Nothing here leaves your browser — the Access Key is used locally and never transmitted.
1 · Credentials
Issued with your tenant by CAKE Support. The Access Key is a server-side secret — never embed it in a mobile app.
2 · Request
The method, path and body are all signed, so every one of them must match the request you actually send.
The hash covers the body byte for byte. Reformatting it after signing — even changing whitespace — invalidates the signature.
3 · Scheme variants
Both of these are genuinely ambiguous in the published documentation. Confirm with the CAKE backend team which one your tenant expects.
Every sample in the docs uses ATV <ACCESS_ID>:<SIGNATURE>.
4 · StringToSign
Newlines shown as ⏎ so you can see exactly what is hashed.
—
—
5 · Headers
Fill in the fields to sign.
7 · Verify a response signature
Responses are signed with the same algorithm over the response body. Recompute and compare before trusting a verdict such as is_verified — an unverified response is an unauthenticated one.