Authentication

A Commune API key, sent as Authorization: Bearer <key>. Keys are issued per newsletter and carry either public or creator scope.

An HMAC over the raw body of a webhook request, sent with the timestamp it was signed at in Commune-Timestamp. This is the credential Commune presents to a consumer, which is why every operation under webhooks declares it rather than inheriting the document level API key: that one travels the other way. Verify against the raw bytes before parsing the JSON, and reject a timestamp outside your tolerance window so a captured request cannot be replayed later.