If you’re using a Workflow as a way to trigger hooks into internal tooling, it’s recommended to validate that the request is actually originating from Cortex using request signing. Signing secrets are added to requests coming from Workflow blocks.
The following headers are added to each request made by Cortex. Use these headers to verify that the request is valid and originated from Cortex:
x-cortex-timestamp- This header uses the current timestamp in millis, and is used to prevent replay attacks. Cortex signs the requests using the format <timestamp>.<body>.x-cortex-timestamp-only-signature-256 - This header calculates the SHA256 signature using only the timestamp. Use this header in environments where the HTTP request body is unavailable due to platform limitations.x-cortex-signature-256 - This header uses the SHA256 algorithm. For security best practices, use this header rather than x-cortex-signature.x-cortex-signature - This header uses the SHA1 algorithm and exists for backward compatibility. SHA1 is considered unsafe and this signature should be considered deprecated.
To configure a signing secret:
- From the main sidebar, click your avatar in the bottom-left corner.
- Click Settings.
- From the Settings menu, locate the Security and access section, then click Secrets.
- Under Request signing secret, enter a secret into the text field. The secret can be made up of letters, digits, special characters, and hyphens.
- Copy and store the secret. Once the secret is saved, there’s no way to view it in the Cortex UI.
- Click Save secret.
- Calculate the signature (an RFC2104 HMAC):
- Create a string with the value
$timestamp.$requestBody if the request body is non-null OR $timestamp if the request body is null.
- Calculate an HMAC using the SHA256 algorithm. Use the secret you provided to Cortex as the key and the string from Step A above as the payload.
- Verify that the
x-cortex-signature-256 matches the HMAC calculated in Step B above.
Last modified on September 9, 2026
