Response Signatures

All API responses include cryptographic signatures for integrity verification.

Verification Process

1. Server signs response with private key
2. Signature included in response header
3. Client verifies using public key
4. Timestamp checked (5-minute window)
5. Nonce validated against replay attacks

if (response.SignatureValid) {
    // Response is authentic
    ProcessResponse(response);
} else {
    // Possible tampering
    LogError("Invalid signature");
}