Skip to main content
Every request to the Serving API carries a signature computed from the signing key held by an Application. Livry validates the signature before serving a theme.

​
Where the key comes from

Livry issues a private key when you create an Application. It is shown once. Store it wherever you keep server-side secrets — for an Azure-hosted app, Key Vault or an app setting. Create a separate Application for each consuming surface that fetches themes independently, so a rotation or compromise is scoped to one surface rather than all of them.

​
Constructing a signature

This section is not yet written. The exact signing scheme — which URL components are covered by the hash, the canonical string format, the hash algorithm, and whether the signature carries an expiry — needs to be documented from the implementation before anyone can integrate against it.Do not publish this page until the scheme is specified here with a worked example.

​
Rotation

Not yet written. Document whether an Application can hold two active keys during rotation, and what the cutover looks like.