API request format

Do not sign arbitrary serialized JSON directly.

Use a fixed, versioned signing input:

CRE8-REQUEST-V1
credential_id:<credential-id>
component_version:<version>
method:<uppercase-method>
path:<normalized-path>
query_hash:<sha256-of-normalized-query>
body_hash:<sha256-of-exact-body-bytes>
timestamp:<unix-seconds>
nonce:<random-base64url>
audience:<cre8-api-origin>

The client signs those exact bytes with the authentication private key.

Suggested headers:

CRE8-Credential-ID
CRE8-Component-Version
CRE8-Timestamp
CRE8-Nonce
CRE8-Body-Digest
CRE8-Auth-Signature
CRE8-Purpose-Signature

The server must:

Parse with strict size limits.
Locate the public authentication component.
Reject unknown or inactive versions.
Check the timestamp window.
atomically record the nonce.
Reject repeated nonces.
Recalculate the body digest.
Verify the authentication signature.
Verify a purpose signature where required.
Evaluate effective permissions.
Apply limits.
Record the authorization decision.
Execute the operation.

For signed policy documents and authorship metadata, use a deterministic representation such as JSON Canonicalization Scheme. JCS exists specifically to produce invariant JSON representations suitable for hashing and signing.