Keep AXIOS authority on the server side.
Protocol v4 binds each bridge request to the tenant, registered FiveM server, request timestamp, idempotency key, HTTP method, route and request body hash.
Protocol v4 request headers
| Header | Purpose |
|---|---|
Content-Type | JSON request encoding. |
X-CAD-Tenant-ID | Tenant scope for the registered server. |
X-CAD-Server-Key | Public identifier for the registered FiveM server. |
X-CAD-Timestamp | Freshness/replay protection input. |
X-CAD-Signature | HMAC-SHA256 signature over the canonical request. |
X-Idempotency-Key | Stable mutation identifier used to make retries safe. |
Canonical signing input
Protocol v4
v4
<timestamp>
<tenant-id>
<server-key>
<idempotency-key>
<HTTP-METHOD>
<path>
<sha256(body)>Do not expose the server secret.Never place the HMAC secret in client Lua, JavaScript, NUI, browser code, screenshots or support logs. Custom FiveM resources should prefer the named server exports so signing remains inside the AXIOS bridge.
Default-deny resource access
The bridge can restrict authoritative calls by invoking FiveM resource. Treat that allow-list as part of your deployment configuration: a resource being able to call a Lua export does not mean it should automatically be trusted for every mutation.
Credential rotation
When a server secret is rotated, update the server-side AXIOS bridge configuration and restart/revalidate the bridge. Do not copy old credentials into public documentation or customer resources.