# description
A digitally signed authentication credential transmitted in the HTTP `Signature` response header on every synchronous Beckn response, proving that the responding NP received and authenticated the specific inbound request.

The responding actor produces this by signing a four-line canonical signing string with its Ed25519 private key:

    (created): {unix_timestamp}
    (expires): {unix_timestamp}
    digest: BLAKE2b-512={base64_response_body_hash}
    request-signature: {incoming_request_raw_base64_signature}

The fourth line (`request-signature`) contains the raw Base64 Ed25519 signature value extracted verbatim from the `signature="..."` field of the incoming request's `Authorization` header. This binds the Ack cryptographically to the specific signed request that triggered it.

The `headers` attribute MUST be `"(created) (expires) digest request-signature"`. The `keyId` identifies the responding NP. The algorithm MUST be `ed25519`. The body digest covers the response body using BLAKE2b-512.

Used for: all synchronous HTTP responses across all Beckn endpoints. For request signing, see Signature. For PN solicited callback signing, see CallbackSignature. See NFH-004 Authentication and Trust §5 for the full response signing procedure.