---
title: "Require signed requests for this key"
method: POST
path: "/v1/inbound_signing"
tags: ["API keys"]
---

# Require signed requests for this key

`POST /v1/inbound_signing`

## Request

- Base URL: `https://api.affiliaterail.com`
- URL: `https://api.affiliaterail.com/v1/inbound_signing`
- Auth: HTTP bearer

Applies to the key making the call. With `required: true`, every later request with this key must carry a valid `Rail-Signature` header: `t=<unix seconds>,v1=<hex hmac-sha256(secret, "{t}.{raw body}")>` where the secret is the full API key string. Five-minute tolerance. `required: false` turns the requirement off; a signature sent voluntarily is always verified either way.

**Scope:** `write`

## Request body

- InboundSigningUpdate
  - `required` boolean, required

## Response `200`

The setting as stored

- InboundSigning
  - `object` 'inbound_signing', required
  - `key_id` string, required
  - `required` boolean, required

## Other responses

- `400`: Invalid request
- `401`: Missing or unknown API key
- `403`: Key lacks the required scope
- `404`: No such object in your organization
- `422`: The request was understood and refused
- `429`: Rate limited: see Retry-After

---

[API](https://skmtc.dev/affiliaterail/apis/affiliaterail-api.md) · [All operations](https://skmtc.dev/affiliaterail/apis/affiliaterail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/affiliaterail/apis/affiliaterail-api/revisions/ea41f345c092?raw)