# API Signer

Hands-off signing for the flows you predefine — automatic approvals, under rules you set.

High-volume flows cannot wait for a tap per transfer, and giving a service unlimited signing
authority is how a compromised key becomes a company-ending incident. API signing runs the flows
you predefine, authenticated per request and bounded by the same policy engine your people answer
to.

## Authenticated, bounded, logged

- **Signed, timestamped requests** — every call carries an HMAC-SHA256 signature over its payload
  and a timestamp, so a replayed or tampered request is rejected before it reaches business logic.
- **One share of three** — the signer holds a share, not a key. Compromising the machine yields
  something that cannot sign alone, and policy bounds what it could ever have signed.
- **Automation inside the rules** — below your threshold flows proceed; above it they wait for
  people, exactly as a manual request would.
- **Governed keys** — creating or changing an API key is an approval-gated action, recorded like
  any other sensitive change.

## What it is for

Withdrawal queues that drain themselves within limits, deposit sweeps that sign without a human
tap, and every automated signature landing in the same audit trail as a manual one.

## FAQ

**Is this a private key on our server?**
No — one MPC share of three, policy-bound. There is no key on the server to steal.

**Who sets the limits?**
You do, and rule changes are approval-gated, so automation cannot widen its own mandate.

## Related

- [Server Co-Signer](/features/server-co-signer)
- [Policy Engine](/features/policy-engine)
- [Automation Workflows](/features/automation-workflows)
- [Dashboard + API](/features/dashboard-and-api)