Trigger DNS verification

BASALTIC-HMAC-SHA256 request signing for service-account (access-key) auth. An AWS-SigV4-style scheme: an HMAC-SHA256 over a canonical request, keyed by a signing key derived from your secret access key. The basaltic CLI does this for you; the steps below are for a non-CLI client.

Headers you send

• Authorization (this scheme) — format below.
• X-Date: request time in UTC, compact ISO-8601 basic: YYYYMMDDTHHMMSSZ (e.g. 20240115T103000Z). Must be within 5 minutes of server time.
• X-Nonce: random per-request value (e.g. 16+ bytes of hex). Required — it is what makes each signature unique so the server can reject replays. X-Date alone is not enough (one-second resolution; UNSIGNED-PAYLOAD never enters the canonical request).
• X-Content-Sha256 (optional): lowercase-hex SHA-256 of the request body, to bind the exact bytes to the signature — the server re-hashes and rejects a mismatch. Omit it, and put the literal UNSIGNED-PAYLOAD in the body-hash slot, for an empty body or a streaming upload that shouldn't be buffered.

Authorization header format

Authorization: BASALTIC-HMAC-SHA256 Credential=<access_key_id>/<date>/<region>/<service>/basaltic_request, SignedHeaders=<h1>;<h2>, Signature=<hex>

• <date>: YYYYMMDD (the day part of X-Date).
• <region>: target region code (e.g. sa-saopaulo-1), or global for the region-agnostic (IAM) endpoints.
• <service>: basaltic.
• SignedHeaders: the covered header names, lowercased and sorted, joined by ; — at minimum host;x-date;x-nonce (all three required).
• Signature: lowercase hex from step 4.
• Note the , (comma + space) between the three Authorization parameters.

Step 1 — canonical request

Join these six lines with \n (LF):

<HTTP-METHOD>
<canonical-path>
<canonical-query>
<canonical-headers>
<signed-headers>
<body-hash>

• canonical-path: the URL-escaped request path (e.g. /v1/compute/instances).
• canonical-query: each query key and value URL-encoded, sorted by key then value, joined by &; empty string when there is no query.
• canonical-headers: for each signed header, name:value (name lowercased, value trimmed), sorted by name, each followed by a trailing \n.
• signed-headers: the same names, lowercased, sorted, joined by ;.
• body-hash: lowercase-hex SHA-256 of the body, or the literal UNSIGNED-PAYLOAD.

Step 2 — string to sign

Join with \n:

BASALTIC-HMAC-SHA256
<date>T000000Z
<date>/<region>/<service>/basaltic_request
<hex SHA-256 of the canonical request>

The second line is the credential date at midnight — NOT the X-Date value — and the third is the credential scope without the access-key id.

Step 3 — derive the signing key (HMAC chain over your secret)

kDate    = HMAC-SHA256("BASALTIC" + <secret_access_key>, <date>)
kRegion  = HMAC-SHA256(kDate, <region>)
kService = HMAC-SHA256(kRegion, <service>)
kSigning = HMAC-SHA256(kService, "basaltic_request")

Step 4 — signature

Signature = lowercase_hex( HMAC-SHA256(kSigning, <string-to-sign>) )

Example (POST with a JSON body)

X-Date: 20240115T103000Z
X-Nonce: 7f3a9c2e1b84d056
X-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Authorization: BASALTIC-HMAC-SHA256 Credential=BCAK1234567890ABCDEF/20240115/global/basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature=a1b2c3d4e5f6...

Request validity

• Valid for 5 minutes from the X-Date timestamp.
• The signature must cover at least host, x-date, and x-nonce.
• Mutating requests (POST/PUT/PATCH/DELETE) that present a signed nonce are anti-replay guarded for the drift window; omitting X-Nonce is rejected.

Rate limits

There is no global request budget: a limit applies only where an operation documents a 429 response, and each such endpoint counts its own fixed window. Everything else is bounded by quota, not by request rate.

Per-endpoint request limits

A few endpoints are limited in front of the handler, counted per caller — the authenticated principal when the request carries credentials, the client IP otherwise. On this API surface that is the public region catalogue, GET /v1/regions: it guards no secret, and the budget is there because the catalogue is unauthenticated and database-backed.

An operation that is limited says so by documenting a 429. These responses — 429 and 2xx — carry the budget, so a client can pace itself instead of discovering the ceiling by hitting it:

• X-RateLimit-Limit — requests allowed per window on this endpoint. Authoritative: read it rather than hard-coding a number.
• X-RateLimit-Remaining — requests left in the window (0 on a 429).
• X-RateLimit-Reset — seconds until the window resets. A duration, not a timestamp, so it needs no clock agreement.
• Retry-After — on a 429 only; seconds to wait. Never zero.

Over the limit the response is 429 with error code RATE_LIMITED. Honor Retry-After — retrying sooner is refused and extends the window, since the refused attempt is itself counted.

Service-level limits

Some resources meter the work itself rather than the request, and are documented on the operation. They return 429 with their own error code and no rate-limit headers, because the budget is not a per-endpoint window: sending email is capped per (account, identity) per second (EMAIL_RATE_LIMIT), and charge attempts are capped per invoice (INVOICE_PAYMENT_ATTEMPTS_EXHAUSTED).

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.