Concealed-Auth-Export

The HTTP Concealed-Auth-Export request header carries the TLS key exporter output a frontend extracted from the client connection, letting a separate backend verify a Concealed Authentication signature it could never derive on its own.

Table of Contents

Usage

The Concealed scheme signs a TLS key exporter value, material available only on the TLS connection between the client and whichever server terminates the encryption. A TLS-terminating frontend passing requests to a separate backend leaves the backend without access to the material, so the frontend extracts the 48-byte exporter output and sends the value to the backend in Concealed-Auth-Export, alongside the client's unmodified Authorization or Proxy-Authorization header.

Trust does the security work. A forged exporter value lets a forged signature verify, so a backend ignores the header unless the sender is already trusted, and a frontend strips any Concealed-Auth-Export a client supplied before adding its own. The trust relationship holds because the frontend already holds the TLS certificate private key, the same level of access the exporter material represents.

The pattern mirrors Client-Cert and Client-Cert-Chain, where a TLS-terminating proxy forwards TLS-layer evidence to a backend over a trusted hop.

Values

Byte sequence

The value is a Structured Fields Byte Sequence holding the 48-byte key exporter output, without parameters. The encoding is standard Base64 between colons, the non-URL-safe variant, so + and / appear where the URL-safe alphabet uses - and _.

Example

A frontend terminates TLS, extracts the exporter output for the Concealed signature check, and forwards the request to the backend with the original credentials intact.

GET /restricted HTTP/1.1
Host: backend.example.re
Authorization: Concealed k=YmFzZW1lbnQ, a=VGhpcyBpcyBh-HB1YmxpYyBrZXkgaW4gdXNl_GhlcmU, s=2055, v=dmVyaWZpY2F0aW9u_zE2Qg, p=QzpcV2luZG93c_xTeXN0ZW0zMlxkcml2ZXJz-ENyb3dkU3RyaWtlXEMtMDAwMDAwMDAyOTEtMD-wMC0w_DAwLnN5cw
Concealed-Auth-Export: :VGhpc+BleGFtcGxlIFRMU/BleHBvcnRlc+BvdXRwdXQ/aXMgNDggYnl0ZXMgI/+h:

The backend looks up the key ID, confirms the public key matches its database, checks the verification field against the exporter output, and verifies the signature before serving the request.

See also

Last updated: August 18, 2026