How can Netlify sign requests sent through a proxy redirect?

Definition: Netlify can sign every proxy request to an external URL with a JSON Web Signature (JWS). A redirect rule names a secret environment variable with signed, and Netlify sends the resulting HMAC HS256 signature in the x-nf-sign request header.

Key facts

• Netlify uses a JSON Web Signature (JWS) for proxy requests to an external URL.
• The signed value is the name of the environment variable that contains the secret token.
• The environment variable scope must include Runtime for signed proxy redirects.
• Netlify injects the variable automatically and sends the JWS as an HMAC HS256 encoded x-nf-sign header with every proxied request.
• Signed proxy redirects must be declared in the Netlify configuration file.

What does the signed option configure?

Netlify describes proxy rules as a way to let parts of a site proxy to external services. It documents JWS signing for this external proxy case. The redirect rule uses signed as a variable name, rather than placing the token itself in the rule. The documented example is:

[[redirects]]
  from = "/search"
  to = "https://api.mysearch.com"
  status = 200
  force = true
  signed = "API_SIGNATURE_TOKEN_PLACEHOLDER"

The rule belongs in the Netlify configuration file. The to value in the example is an external service and the status is 200.

Which environment variable scope is required?

Netlify's environment variables overview describes each variable as having a key name, a scope, and one or more contextual values. By default, a variable applies to all scopes and has the same value for all deploy contexts. You can limit a variable to selected scopes; the Runtime scope includes signed proxy redirects and provides security tokens for forms and redirects while the site runs in the browser.

For a signed proxy redirect, create the token as a site environment variable and use its key as the signed value. The proxy documentation says Netlify injects the value automatically, so the token does not need to be substituted into the configuration file. If you use contextual values, the environment-variable documentation lists Production, Deploy Previews, Branch deploys, Preview server, and Local development as deploy contexts, with a separate value possible for each.

What does the destination receive?

Netlify sends the JWS in the x-nf-sign request header to another, non-Netlify website with every proxied request. The signature is encoded with HMAC HS256. The signed JSON document in Netlify's example has these fields:

{
  "deploy_context": "production",
  "exp": 1623876755,
  "iss": "netlify",
  "netlify_id": "1be0f471-6532-45ff-b1b1-f9c66ea24dc1",
  "site_url": "https://mysitename.netlify.app"
}

The example identifies the deploy context, an expiration value, the issuer, the site identifier, and the site URL. Netlify's documentation limits this feature to external sites: JWS signing is unsupported when proxying from one Netlify application to another.

Related terms

• How do I add redirects with Netlify's _redirects file?
• How do I target Netlify response headers to a directory?
• Which Netlify redirect wins when file and configuration rules overlap?

FAQ

Where does the secret go?

Store the token in a site environment variable and put that variable's key in the signed field. Netlify's proxy documentation says it injects the value automatically.

Does the rule use a custom request header?

The signature is sent in Netlify's x-nf-sign header. The signed option selects the secret variable; it is separate from the custom headers map documented for proxy redirects.

Can a signed rule target another Netlify site?

No. Netlify documents JWS signing for external URLs and says it is unsupported when one Netlify application proxies to another.

Sources

1. Netlify Docs, "Rewrites and proxies", 14 July 2025
2. Netlify Docs, "Environment variables overview", 3 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer