HMAC

Hash-based Message Authentication Code (HMAC) provides strong security for Optimizely Graph requests by ensuring message integrity and authenticity. It combines a secret key with a cryptographic hash function, making it suitable for applications that handle sensitive data, such as financial services. HMAC protects communications from unauthorized access and tampering.

Include the HMAC values in the Authorization header using the following format:

Use your APP_KEY and SECRET credentials to implement HMAC.

When you authenticate requests using HMAC, Optimizely Graph returns content based on the following default rules:

By default, querying with HMAC is equivalent to querying as a super user. Optimizely Graph returns all content regardless of publication status or role-based access control (RBAC) restrictions.

Include specific request headers to change how Optimizely Graph evaluates access and filtering. These headers enforce RBAC rules or include content that Optimizely Graph normally excludes.

Use the cg-username and cg-roles headers together to apply RBAC filtering.

Required headers

When both headers are present, Optimizely Graph returns only content that the specified user or roles can access.

A content item is returned if it includes at least one of the following permissions:

Example

In this example, Optimizely Graph returns content that meets any of the following conditions:

HTTP header values carry only ASCII characters. A username or role that contains a character such as å, ä, or ö does not fit this restriction. Percent-encode the value as described in RFC 3986. Optimizely Graph decodes the header before it evaluates access.

Optimizely Graph decodes the two headers as follows:

The split happens before decoding, so a comma in the header always separates roles. To include a comma in a role name, encode it as %2C.

The following example sends the username fö[email protected] and the roles Redaktör and Team Alpha:

Keep the following behavior in mind:

Encode the header values in the client that calls Optimizely Graph. A client that puts non-ASCII characters straight into a header fails before it sends the request. The HTTP library rejects the value first.

Use the following optional headers to expand or filter the result set:

The following example shows a GraphQL query authenticated with HMAC and filtered using RBAC headers.

HMAC authentication supports both unrestricted access for system-level integrations and fine-grained access control through request headers. This flexibility lets you query content securely while aligning results with CMS permissions when required.