PHPackages 99designs/http-signatures - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [HTTP & Networking](/categories/http) 4. / 5. 99designs/http-signatures ActiveLibrary[HTTP & Networking](/categories/http) 99designs/http-signatures ========================= Sign and verify HTTP messages 4.0.0(9y ago)47791.1k↓68.6%35[7 issues](https://github.com/99designs/http-signatures-php/issues)[4 PRs](https://github.com/99designs/http-signatures-php/pulls)4MITPHPPHP >=5.5CI failing Since Jul 31Pushed 2y ago55 watchersCompare [ Source](https://github.com/99designs/http-signatures-php)[ Packagist](https://packagist.org/packages/99designs/http-signatures)[ RSS](/packages/99designs-http-signatures/feed)WikiDiscussions master Synced 2d ago READMEChangelog (8)Dependencies (8)Versions (21)Used By (4) HTTP Signatures =============== [](#http-signatures) PHP implementation of [HTTP Signatures](http://tools.ietf.org/html/draft-cavage-http-signatures-03) draft specification; allowing cryptographic signing and verifying of [PSR7 messages](http://www.php-fig.org/psr/psr-7/). See also: - - Usage ----- [](#usage) Add [99designs/http-signatures](https://packagist.org/packages/99designs/http-signatures) to your [composer.json](https://getcomposer.org/). Configure a context with your algorithm, keys, headers to sign. This is best placed in an application startup file. ``` use HttpSignatures\Context; $context = new Context([ 'keys' => ['examplekey' => 'secret-key-here'], 'algorithm' => 'hmac-sha256', 'headers' => ['(request-target)', 'Date', 'Accept'], ]); ``` If there's only one key in the `keys` hash, that will be used for signing. Otherwise, specify one via `'signingKeyId' => 'examplekey'`. ### Messages [](#messages) A message is assumed to be a PSR-7 compatible request or response object. #### Signing a message [](#signing-a-message) ``` $context->signer()->sign($message); ``` Now `$message` contains the signature headers: ``` $message->headers->get('Signature'); // keyId="examplekey",algorithm="hmac-sha256",headers="...",signature="..." $message->headers->get('Authorization'); // Signature keyId="examplekey",algorithm="hmac-sha256",headers="...",signature="..." ``` #### Verifying a signed message [](#verifying-a-signed-message) ``` $context->verifier()->isValid($message); // true or false ``` ### Symfony compatibility [](#symfony-compatibility) Symfony requests normalize query strings which means the resulting request target can be incorrect. See When creating PSR-7 requests you use `withRequestTarget` to ensure the request target is correct. For example ``` use Symfony\Bridge\PsrHttpMessage\Factory\DiactorosFactory; use Symfony\Component\HttpFoundation\Request; $symfonyRequest = Request::create('/foo?b=1&a=2'); $psrRequest = (new DiactorosFactory()) ->createRequest($symfonyRequest) ->withRequestTarget($symfonyRequest->getRequestUri()); ``` Contributing ------------ [](#contributing) Pull Requests are welcome. License ------- [](#license) HTTP Signatures is licensed under [The MIT License (MIT)](LICENSE). ### Health Score 45 — FairBetter than 91% of packages Maintenance17 Infrequent updates — may be unmaintained Popularity51 Moderate usage in the ecosystem Community37 Small or concentrated contributor base Maturity67 Established project with proven stability Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~59 days Recently: every ~49 days Total 18 Last Release 3347d ago Major Versions v1.1.0 → v2.0.02015-03-08 v1.1.2 → v2.0.22015-09-17 2.0.4 → 3.02016-09-20 2.0.5 → 3.1.22017-05-04 3.1.2 → 4.0.02017-05-04 PHP version history (3 changes)v0.1.0PHP >=5.3.0 v2.0.3PHP >=5.3.3 3.0PHP >=5.5 ### Community Maintainers ![](https://www.gravatar.com/avatar/61d94165c13417941a32d14d4468f27868c7643e96495090cfd33009055ea48c?d=identicon)[mtibben](/maintainers/mtibben) ![](https://avatars.githubusercontent.com/u/1178572?v=4)[Giacomo Gatelli](/maintainers/arthens)[@arthens](https://github.com/arthens) ![](https://avatars.githubusercontent.com/u/29794?v=4)[Paul Leitmanis](/maintainers/sinamt)[@sinamt](https://github.com/sinamt) --- Top Contributors [![pda](https://avatars.githubusercontent.com/u/15759?v=4)](https://github.com/pda "pda (54 commits)")[![navitronic](https://avatars.githubusercontent.com/u/180519?v=4)](https://github.com/navitronic "navitronic (24 commits)")[![mtibben](https://avatars.githubusercontent.com/u/980499?v=4)](https://github.com/mtibben "mtibben (18 commits)")[![vinkla](https://avatars.githubusercontent.com/u/499192?v=4)](https://github.com/vinkla "vinkla (6 commits)")[![liamdennehy](https://avatars.githubusercontent.com/u/4996358?v=4)](https://github.com/liamdennehy "liamdennehy (6 commits)")[![rubensayshi](https://avatars.githubusercontent.com/u/649160?v=4)](https://github.com/rubensayshi "rubensayshi (5 commits)")[![hannesvdvreken](https://avatars.githubusercontent.com/u/1410358?v=4)](https://github.com/hannesvdvreken "hannesvdvreken (1 commits)")[![peter279k](https://avatars.githubusercontent.com/u/9021747?v=4)](https://github.com/peter279k "peter279k (1 commits)")[![harto](https://avatars.githubusercontent.com/u/103448?v=4)](https://github.com/harto "harto (1 commits)")[![vektah](https://avatars.githubusercontent.com/u/2247982?v=4)](https://github.com/vektah "vektah (1 commits)")[![feenx](https://avatars.githubusercontent.com/u/9256168?v=4)](https://github.com/feenx "feenx (1 commits)")[![poisa](https://avatars.githubusercontent.com/u/348248?v=4)](https://github.com/poisa "poisa (1 commits)") --- Tags httphttpssignaturesigninghmacsigned ### Code Quality TestsPHPUnit Code StylePHP CS Fixer ### Embed Badge ![Health badge](/badges/99designs-http-signatures/health.svg) ``` [![Health](https://phpackages.com/badges/99designs-http-signatures/health.svg)](https://phpackages.com/packages/99designs-http-signatures) ``` ### Alternatives [guzzlehttp/psr7 PSR-7 message implementation that also provides common utility methods 8.0k1.1B4.0k](/packages/guzzlehttp-psr7)[phpseclib/phpseclib PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc. 5.6k465.6M1.5k](/packages/phpseclib-phpseclib)[league/uri-interfaces Common tools for parsing and resolving RFC3987/RFC3986 URI 539238.7M44](/packages/league-uri-interfaces)[99designs/http-signatures-guzzlehttp Sign and verify HTTP messages with Guzzle 6 13205.4k5](/packages/99designs-http-signatures-guzzlehttp)[oat-sa/tao-core TAO core extension 66143.7k122](/packages/oat-sa-tao-core)[laudis/neo4j-php-client Neo4j-PHP-Client is the most advanced PHP Client for Neo4j 185702.8k43](/packages/laudis-neo4j-php-client) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)