HMAC

Hash-based Message Authentication Code (HMAC) provides strong security for Optimizely Graph requests by ensuring message integrity and authenticity. It combines a secret key with a cryptographic hash function, making it suitable for applications that handle sensitive data, such as financial services. HMAC protects communications from unauthorized access and tampering.

Include the HMAC values in the Authorization header using the following format:

Use your APP_KEY and SECRET credentials to implement HMAC.

When you authenticate requests using HMAC, Optimizely Graph returns content based on the following default rules:

By default, querying with HMAC is equivalent to querying as a super user. Optimizely Graph returns all content regardless of publication status or role-based access control (RBAC) restrictions.

Include specific request headers to change how Optimizely Graph evaluates access and filtering. These headers enforce RBAC rules or include content that Optimizely Graph normally excludes.

Use the cg-username and cg-roles headers together to apply RBAC filtering.

Required headers

When both headers are present, Optimizely Graph returns only content that the specified user or roles can access.

A content item is returned if it includes at least one of the following permissions:

Example

In this example, Optimizely Graph returns content that meets any of the following conditions:

Use the following optional headers to expand or filter the result set:

The following example shows a GraphQL query authenticated with HMAC and filtered using RBAC headers.

HMAC authentication supports both unrestricted access for system-level integrations and fine-grained access control through request headers. This flexibility lets you query content securely while aligning results with CMS permissions when required.