topic
Verified 2026-09-18

HTTP Message Signatures

HTTP Message Signatures let a sender sign selected message components for integrity and authentication.

Use Signature-Input and Signature with a defined key and component list. Decide which intermediaries may change signed fields before forwarding a request.

httpsecurityauthintegrity

Reference (http)

Signature-Input: sig1=("@method" "@target-uri" "content-digest");created=1720000000;keyid="api-key"

Use Signature-Input and Signature with a defined key and component list. Decide which intermediaries may change signed fields before forwarding a request.

Common mistakes

  • Signing a field without defining canonicalization, freshness, key rotation, or replay protection.

Sources

Permalink: https://merginit.com/reference/http/http-signatures