http-signatures

What problem does it solve?

Securely sign and verify HTTP requests to ensure integrity and authenticity when interacting with APIs that implement the HTTP Signatures standard. This library provides a ready-to-use Java implementation that reduces boilerplate, handles key management, and aligns with RFC-like signing guidance.

Core Features & Use Cases

• Signing requests: build a signing string from selected headers and sign with a private key.
• Verification: parse and verify incoming Authorization headers against known public keys.
• Flexible algorithms: support HMAC, RSA, ECDSA, and DSA choices and timing checks for created/expires fields.
• Use Case: integrate with a microservice that signs outgoing requests and validates responses in a secure service mesh.

Quick Start

Sign a sample HTTP request using a test private key and verify the resulting Authorization header.