SDK request signing

Enable HMAC request signing to block replayed or tampered SDK traffic. Off by default; turn on per deployment or per product.

Enable

• Global: AUTHIX_SDK_SIGNING_SECRET (32+ chars) and AUTHIX_SDK_REQUIRE_SIGNATURE=true
• Per product: settings.sdkSigningSecret and settings.sdkRequireSignature

Headers

Send on every SDK POST:

• X-Authix-Timestamp — Unix ms
• X-Authix-Nonce — unique per request
• X-Authix-Signature — HMAC-SHA256 hex of POST\n{route}\n{timestamp}\n{nonce}\n{sha256(stableJson(body))}

Server proofs (Ed25519) and download grants remain unchanged.