{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/overview/security/secure-communication","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/overview/security/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/overview/security/secure-communication","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/overview/security/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/overview/security/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/overview/security/secure-communication","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/overview/security/secure-communication","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Secure communication","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"secure-communication","__idx":0},"children":["Secure communication"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ripple Custody"," protects all communications with multiple cryptographic layers: TLS, JWT authentication, mTLS, and application-layer signing."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TLS 1.2+"]}," encrypts all network traffic between components."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JWT tokens"]}," authenticate every API request with cryptographic signatures."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS"]}," provides mutual authentication for critical internal platform connections."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application signing"]}," ensures message integrity for requests, trusted-state attestations, and vault signing work."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Communication security prevents man-in-the-middle attacks, credential theft, and message tampering. Even if an attacker gains network access, the layered security model ensures they cannot intercept sensitive data or forge authorized requests. This is essential for meeting SOC 2, ISO 27001, and other security compliance requirements."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["For architects and operators"]},": You are responsible for providing TLS certificates and configuring your PKI. Plan certificate rotation procedures before deployment. Ensure your network infrastructure supports encrypted and mutually authenticated communication for internal protected-component paths."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Prerequisites"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before reading this page, you should understand:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/overview/security-model"},"children":["Security model"]}," - The overall security model and zero-trust principles"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform implements defense-in-depth for all communications:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Layer"},"children":["Layer"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Protection"},"children":["Protection"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Transport"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS 1.2+"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Encrypts all network traffic"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JWT tokens"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authenticates API requests"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mutual authentication"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["mTLS certificates"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verifies both sides of critical internal component connections"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Digital signatures"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ensures message integrity and non-repudiation"]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Key Takeaway"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These controls work together to prevent ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["man-in-the-middle attacks"]},". Even if an attacker intercepts network traffic, they cannot decrypt it (TLS), impersonate a user (JWT signatures), or impersonate a trusted component (mTLS certificates). Messages between the notary and vault are additionally signed at the application layer, providing defense-in-depth."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication","__idx":2},"children":["Authentication"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"jwt-authentication","__idx":3},"children":["JWT authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JSON Web Token (JWT)"]}," is a compact, digitally signed token that proves a user's identity without requiring the server to look up session data. Think of it as a tamper-proof ID badge: it contains claims about who you are, is signed by a trusted authority, and can be verified by any component that trusts that authority."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All requests to the API backend must authenticate using a JWT passed as a bearer token."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Aspect"},"children":["Aspect"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Details"},"children":["Details"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity provider"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Authentication Server (a dedicated OIDC server) verifies user identity and issues JWTs"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token expiration"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Default is four hours"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Obtaining a JWT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Challenge-response: user signs a random challenge with their private key; server validates and returns JWT"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Challenge reuse"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Challenges can only be used once to prevent replay attacks"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"digital-signatures-for-authorization","__idx":4},"children":["Digital signatures for authorization"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Any request (Intent) to change the system state requires a digital signature. This proves the request came from the claimed user and has not been modified."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["How it works"]},": The user's application creates a unique \"fingerprint\" of the request and signs it with their private key. The platform verifies this signature using the user's registered public key. If even one character of the request was changed, the signature becomes invalid."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Technical process:"]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Canonicalization"]},": Request body converted to canonical JSON (spaces removed, properties sorted, null values removed)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Hashing"]},": Canonical JSON hashed using SHA-256."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Signing"]},": Hash signed using the user's private key (stored externally—never communicated to the platform)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Encoding"]},": Signature serialized in DER format with Base64 encoding."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The notary verifies this signature against the user's registered public key. This prevents both impersonation and tampering."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"network-security","__idx":5},"children":["Network security"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"mutual-tls-mtls","__idx":6},"children":["Mutual TLS (mTLS)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Standard TLS (Transport Layer Security) is one-way: the client verifies the server's certificate, but the server doesn't verify the client. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mutual TLS (mTLS)"]}," requires both parties to present and verify certificates — each side proves its identity to the other before any data is exchanged."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," uses mTLS for critical internal component connections to ensure that even if an attacker gains network access, they cannot impersonate a trusted component."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Client integrations"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["mTLS in this section refers to communication between ","Ripple Custody"," platform components. External API clients use HTTPS/TLS, bearer-token authentication, and request signatures for state mutation operations. API clients are not expected to present mTLS client certificates unless you add that requirement at your own ingress, API gateway, or proxy layer."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"your-internal-pki","__idx":7},"children":["Your internal PKI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You must provide TLS entities from your internal PKI:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["CA certificate"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Server certificate"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Server certificate key"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These secure the four ingress endpoints:"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Note"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The endpoints below are examples. Replace ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["open-shift-cluster-domain"]}," with your actual OpenShift cluster domain."]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Endpoint"},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["API Gateway"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["frontend."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Web UI"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenID authentication server"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["notary-bridge."]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["notary Bridge"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"internal-platform-communication","__idx":8},"children":["Internal platform communication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Communication between core components and protected components such as the notary and vault uses:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mechanism"},"children":["Mechanism"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application-layer mutual trust"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Components verify the signed data they receive before relying on it."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Signed messages"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Requests, attestations, and signing work are signed and verified by the receiving component."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Key exchange at setup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A key exchange during system setup builds the chain of trust"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"dependency-connections","__idx":9},"children":["Dependency connections"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connections to infrastructure services you provide:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Service"},"children":["Service"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Security"},"children":["Security"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["KMS/HSM"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Protected notary, vault, and configured system-signing operations"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["mTLS or HSM-specific secure protocol"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PostgreSQL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Data storage"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS; data integrity verified cryptographically by notary"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AMQP (RabbitMQ)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Async message queue"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Container registry"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Container image distribution"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS; image signatures verified"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"blockchain-connections","__idx":10},"children":["Blockchain connections"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Connection"},"children":["Connection"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Indexer to node"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Chain-specific indexers monitor your blockchain nodes (direct or via http_proxy; Bitcoin supports socks5)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Transaction broadcast"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ledger Accounting Service broadcasts signed transactions"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"the-security-lifecycle-in-practice","__idx":11},"children":["The security lifecycle in practice"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A typical governed transaction follows this flow:"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant User\n participant Auth as Auth Server\n participant API as API Gateway\n participant AMQP as AMQP broker\n participant Bridge as Approval / Notary Bridge\n participant Notary\n participant NotaryKMS as Notary KMS\n participant Vault\n participant VaultKMS as Vault KMS\n\n User->>Auth: 1. Authenticate (challenge-response)\n Auth-->>User: JWT token\n\n User->>API: 2. Submit signed Intent (JWT + TLS)\n API-->>User: 3. 202 Accepted with requestId\n API->>AMQP: 4. Queue workflow task\n Bridge->>AMQP: 5. Consume workflow task\n Notary->>Bridge: 6. Poll for signed request and approvals\n Bridge-->>Notary: 7. Return signed request and approvals\n\n Notary->>Notary: 8. Verify user signature, policy, Merkle state, and ARF\n Notary->>NotaryKMS: 9. Sign trusted-state attestation\n NotaryKMS-->>Notary: 10. Return signature\n\n Vault->>API: 11. Poll for attested operation\n API-->>Vault: 12. Return operation and notary attestation\n Vault->>Vault: 13. Verify notary attestation and request data\n Vault->>VaultKMS: 14. Request blockchain transaction signature\n VaultKMS-->>Vault: 15. Return signature only\n Vault-->>API: 16. Submit signed transaction\n","diagramHtml":"Vault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayAuth ServerUserVault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayAuth ServerUser1. Authenticate (challenge-response)JWT token2. Submit signed Intent (JWT + TLS)3. 202 Accepted with requestId4. Queue workflow task5. Consume workflow task6. Poll for signed request and approvals7. Return signed request and approvals8. Verify user signature, policy, Merkle state, and ARF9. Sign trusted-state attestation10. Return signature11. Poll for attested operation12. Return operation and notary attestation13. Verify notary attestation and request data14. Request blockchain transaction signature15. Return signature only16. Submit signed transaction","diagramHtmlDark":"Vault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayAuth ServerUserVault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayAuth ServerUser1. Authenticate (challenge-response)JWT token2. Submit signed Intent (JWT + TLS)3. 202 Accepted with requestId4. Queue workflow task5. Consume workflow task6. Poll for signed request and approvals7. Return signed request and approvals8. Verify user signature, policy, Merkle state, and ARF9. Sign trusted-state attestation10. Return signature11. Poll for attested operation12. Return operation and notary attestation13. Verify notary attestation and request data14. Request blockchain transaction signature15. Return signature only16. Submit signed transaction"},"children":["sequenceDiagram\n participant User\n participant Auth as Auth Server\n participant API as API Gateway\n participant AMQP as AMQP broker\n participant Bridge as Approval / Notary Bridge\n participant Notary\n participant NotaryKMS as Notary KMS\n participant Vault\n participant VaultKMS as Vault KMS\n\n User->>Auth: 1. Authenticate (challenge-response)\n Auth-->>User: JWT token\n\n User->>API: 2. Submit signed Intent (JWT + TLS)\n API-->>User: 3. 202 Accepted with requestId\n API->>AMQP: 4. Queue workflow task\n Bridge->>AMQP: 5. Consume workflow task\n Notary->>Bridge: 6. Poll for signed request and approvals\n Bridge-->>Notary: 7. Return signed request and approvals\n\n Notary->>Notary: 8. Verify user signature, policy, Merkle state, and ARF\n Notary->>NotaryKMS: 9. Sign trusted-state attestation\n NotaryKMS-->>Notary: 10. Return signature\n\n Vault->>API: 11. Poll for attested operation\n API-->>Vault: 12. Return operation and notary attestation\n Vault->>Vault: 13. Verify notary attestation and request data\n Vault->>VaultKMS: 14. Request blockchain transaction signature\n VaultKMS-->>Vault: 15. Return signature only\n Vault-->>API: 16. Submit signed transaction\n"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Step"},"children":["Step"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Security Controls"},"children":["Security Controls"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1-4"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS encryption, JWT authentication, digital signature, request ID tracking"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["5-10"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["mTLS where configured, signature verification, policy evaluation, Merkle state validation, ARF protection, notary KMS isolation"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["11-16"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Application-layer verification, notary attestation checks, vault KMS isolation, signed transaction submission"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"glossary","__idx":12},"children":["Glossary"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Term"},"children":["Term"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Definition"},"children":["Definition"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ARF"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Anti-rewind file. A cryptographically protected file that tracks the current state version to prevent replay attacks. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/overview/security/data-integrity-and-audit-trail#anti-rewind-file-arf"},"children":["Data integrity"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Bearer token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An authentication token included in HTTP request headers. Anyone \"bearing\" the token can use it, so it must be transmitted over TLS."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Canonical JSON"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A standardized JSON format with sorted keys and no whitespace, ensuring the same data always produces the same byte sequence for signing."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DER format"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Distinguished Encoding Rules. A binary encoding for cryptographic data structures like signatures and certificates."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Intent"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A signed request to change system state (e.g., transfer funds, update a policy)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JWT"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JSON Web Token. A compact, signed token containing identity claims, used for stateless authentication."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Mutual TLS. A TLS connection where both client and server present certificates and verify each other's identity."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenID Connect. An identity layer built on OAuth 2.0 that enables authentication and identity verification."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PKI"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Public Key Infrastructure. A system of certificates, certificate authorities, and trust relationships used to verify identities."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TLS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Transport Layer Security. A cryptographic protocol that encrypts network traffic and verifies server identity."]}]}]}]}]}]},"headings":[{"value":"Secure communication","id":"secure-communication","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Authentication","id":"authentication","depth":2},{"value":"JWT authentication","id":"jwt-authentication","depth":3},{"value":"Digital signatures for authorization","id":"digital-signatures-for-authorization","depth":3},{"value":"Network security","id":"network-security","depth":2},{"value":"Mutual TLS (mTLS)","id":"mutual-tls-mtls","depth":3},{"value":"Your internal PKI","id":"your-internal-pki","depth":3},{"value":"Internal platform communication","id":"internal-platform-communication","depth":3},{"value":"Dependency connections","id":"dependency-connections","depth":3},{"value":"Blockchain connections","id":"blockchain-connections","depth":3},{"value":"The security lifecycle in practice","id":"the-security-lifecycle-in-practice","depth":2},{"value":"Glossary","id":"glossary","depth":2}],"frontmatter":{"seo":{"title":"Secure communication"}},"lastModified":"2026-07-27T10:10:43.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.38/overview/security/secure-communication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}