Signing Outgoing Requests

When a job has signing_secret set, Krafter signs every outgoing request with HMAC-SHA256. Two headers are added to the request:

Header	Value
x-krafter-signature	t=<unix>,v1=<hex> — HMAC-SHA256 of <t>.<body>
x-krafter-job-id	The job's UUID

This is the platform-wide scheme: the same signature header arrives on every signed request Krafter makes, for every service. The full verification recipe, with the freshness check that makes v1 worth using, lives on Verifying signatures — this page only notes what is specific to cron.

The signature covers the request body (body field, or empty string if unset), prefixed by the timestamp. Custom headers are not part of the signed payload.

Verification

Both examples — Node.js and Elixir — are on Verifying signatures, together with the tolerance check. Verify x-krafter-signature, and remember that req.rawBody must be the exact bytes Krafter sent: re-serialising parsed JSON will not match.

Storage

The signing_secret value is encrypted at rest using Krafter.Encrypted.Binary. After a job is created, subsequent reads of the job (GET /cron/jobs/:id, list endpoints) do not echo the secret — it is omitted from the response. To rotate, send a new value via Update Job.

Replay protection

The signature covers the timestamp along with the body, so a captured request stops verifying once it is older than your tolerance (we recommend 300 seconds). Check the freshness of t — a signature with no expiry check is a signature a replayer can reuse, and t cannot be rewritten to buy time because it is inside the signed payload.

Cron used to send an unsigned x-krafter-timestamp beside a body-only signature. That header is gone: nothing signed it, so a replayer could set it to whatever they liked.

Retries are signed afresh with their own t, so an honest retry is not a replay. If your endpoint needs each run to be handled once, deduplicate on your own request-id header (set via the job's headers field) or an idempotency key in the body — x-krafter-job-id identifies the job, not the run.