# Authentication

Every REST request and WebSocket upgrade carries `PRE-ACCESS-KEY`, `PRE-ACCESS-TIMESTAMP`, and `PRE-ACCESS-SIGNATURE`. The signature is a Keyed BLAKE2b-256 over the seven-line canonical string defined by the contracts.

- Use current UTC time in RFC3339 format with milliseconds. The default allowed clock skew is five minutes.
- Sign the exact request URI that is sent, including the path and query string.
- Hash the exact request body bytes. Do not reserialize the body after calculating its digest.
- For a WebSocket upgrade, use `GET`, an empty idempotency-key line, and the digest of an empty body.
- Compute a new signature for every request or upgrade; never cache signatures.
- `Correlation-Id` is optional on supported command endpoints. When supplied, it must be a lowercase UUIDv7.