> ## Documentation Index > Fetch the complete documentation index at: https://developers.govworx.ai/llms.txt > Use this file to discover all available pages before exploring further. # Authentication > Credentials and signatures for CAD submissions and GovWorx updates. # Authentication Each direction uses its own credentials. A credential for sending CAD data to GovWorx does not authorize a GovWorx update at a CAD endpoint. ## CAD to GovWorx CAD sends a provisioned, customer-scoped API key as a bearer credential on every call to `POST /cad/v1/incidents`. ``` Authorization: Bearer ``` GovWorx resolves the customer from that credential. The `tenantId` in the event envelope is a cross-check. GovWorx does not use it for routing. ## GovWorx to CAD The baseline webhook profile uses two mechanisms: 1. A provisioned bearer credential that the CAD endpoint uses to authorize GovWorx. 2. A timestamped HMAC-SHA-256 signature that verifies the exact request body and prevents replay. GovWorx sends the signature in `X-GWX-Signature`. It computes the digest over: ``` .. ``` The endpoint reads the raw body before parsing or reserializing JSON, recomputes the digest with its shared secret, compares it in constant time, and rejects timestamps more than 300 seconds from its current time. ## Retries A retry reuses the delivery identifier and the exact request body. It has a new timestamp and signature. See [Reliability](/connections-platform/reliability) for duplicate handling. ## Connector profiles A connector profile can document a security exception when a CAD system cannot meet the baseline. For example, a profile may support a raw-body signature without a timestamp. The profile states the replacement behavior and its security tradeoff; it does not weaken the baseline for other listeners. See how GovWorx records CAD-specific compatibility requirements.