> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livry.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Signed URLs: Authenticating Livry Theme Requests

> Theme requests are authorised with a URL signature computed from an Application's signing key. This page documents the signing scheme.

Every request to the Serving API carries a signature computed from the signing key held by an [Application](/core-concepts). Livry validates the signature before serving a theme.

## Where the key comes from

Livry issues a private key when you create an Application. It is shown once. Store it wherever you keep server-side secrets — for an Azure-hosted app, Key Vault or an app setting.

Create a separate Application for each consuming surface that fetches themes independently, so a rotation or compromise is scoped to one surface rather than all of them.

## Constructing a signature

<Info>
  **This section is not yet written.** The exact signing scheme — which URL components are covered by the hash, the canonical string format, the hash algorithm, and whether the signature carries an expiry — needs to be documented from the implementation before anyone can integrate against it.

  Do not publish this page until the scheme is specified here with a worked example.
</Info>

## Rotation

<Info>
  **Not yet written.** Document whether an Application can hold two active keys during rotation, and what the cutover looks like.
</Info>