User-Agent is optional
Some edge runtimes send requests without aUser-Agent header, and some strip or normalize it. Since 2026-08-27, the API accepts requests with a missing or empty User-Agent: they are counted for observability but never blocked.
We still recommend setting one that identifies your integration, in the vendor-product/version style:
User-Agent automatically, so if you use the SDK there is nothing to do.
Keep API keys in the platform secret store
Edge bundles are deployed artifacts. Never embedsig_ keys in bundled code or public environment configuration; put them in the platform’s secret store and read them at runtime:
- Cloudflare Workers:
wrangler secret put SIGNA_API_KEY, then readenv.SIGNA_API_KEY - Deno Deploy: project environment variables, read via
Deno.env.get("SIGNA_API_KEY") - Vercel Edge Functions: encrypted environment variables, read via
process.env.SIGNA_API_KEY
Errors are JSON, including edge-generated ones
Nearly every error response follows the standard error envelope, including responses generated at the edge before your request reaches the API (security blocks, oversized payloads, rate limits). Two narrow exceptions return HTML instead: oversized URIs (414) and malformed requests rejected by the CDN itself (400), documented in the error catalog. So check theContent-Type header before parsing: