PHPackages sagacorp/http-signatures-php - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [HTTP & Networking](/categories/http) 4. / 5. sagacorp/http-signatures-php ActiveLibrary[HTTP & Networking](/categories/http) sagacorp/http-signatures-php ============================ Sign and verify PSR-7 HTTP messages with HMAC and RSA keys 2.0.2(1y ago)01.8k↓42.9%[1 issues](https://github.com/sagacorp/http-signatures-php/issues)1MITPHPPHP >=8.3 Since Aug 24Pushed 1y agoCompare [ Source](https://github.com/sagacorp/http-signatures-php)[ Packagist](https://packagist.org/packages/sagacorp/http-signatures-php)[ RSS](/packages/sagacorp-http-signatures-php/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (4)Dependencies (8)Versions (5)Used By (1) Signing HTTP Messages PSR-7 Library =================================== [](#signing-http-messages-psr-7-library) [![Build Status](https://camo.githubusercontent.com/f0c1c533fb06cd483e35e4978331a39542f1f83314f2354523920b5209a7086c/68747470733a2f2f7472617669732d63692e6f72672f6c69616d64656e6e6568792f687474702d7369676e6174757265732d7068702e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/liamdennehy/http-signatures-php)[![Documentation Status](https://camo.githubusercontent.com/d79ddb9a34442a7418dd310bfae607628825b675f5525dc12342a9cfde061c8b/68747470733a2f2f72656164746865646f63732e6f72672f70726f6a656374732f687474702d7369676e6174757265732d7068702f62616467652f3f76657273696f6e3d6c6174657374)](https://http-signatures-php.readthedocs.io/en/latest/?badge=latest) PHP implementation of [Signing HTTP Messages](http://tools.ietf.org/html/draft-cavage-http-signatures-10) draft specification; allowing cryptographic signing and verifying of [PSR-7 messages](http://www.php-fig.org/psr/psr-7/). Features -------- [](#features) - Sign HTTP Messages according to [Signing HTTP Message draft IETF RFC version 10](http://tools.ietf.org/html/draft-cavage-http-signatures-10) - Sign & verify messages using HMACs - Sign & verify messages with Asymmetric Keys: - RSA, DSA, EC - Add a `Digest` header, or automatically add the header while signing in a single operation - Verify a `Digest` header while verifying the signature Complete documentation for this library can be found at [Read The Docs](https://http-signatures-php.readthedocs.io/en/latest/) **WARNING:** Version 11 of this library incorporates [phpseclib](http://phpseclib.sourceforge.net/)'s ongoing work on their [version 3.0 implementation](https://github.com/phpseclib/phpseclib/tree/3.0). If there are any problems please log an issue, but as the library has not been stabilised or completely reviewed you are advised to proceed with caution, or remain at v10 of this library until phpseclib 3.0 is complete and the MAJOR version of this library is bumped. Simple Usage ------------ [](#simple-usage) Add [liamdennehy/http-signatures-php](https://packagist.org/packages/liamdennehy/http-signatures-php) to your [`composer.json`](https://getcomposer.org/). - A message is assumed to be a PSR-7 compatible Request or Response. - A `Context` object is used to configure the signature parameters, and prepare the verifier functionality. - The `signWithDigest` function witll add a `Digest` header and digitally sign the message in a new `Signature` header. Signing a PSR-7 request `$message` before sending: ``` use HttpSignatures\Context; $context = new HttpSignatures\Context([ 'keys' => ['mykey' => file_get_contents('/path/to/privatekeyfile')], 'algorithm' => 'rsa-sha256', 'headers' => ['(request-target)', 'Date'], ]); $context->signer()->signWithDigest($message); ``` Complete documentation for this library for other ose cases can be found at [Read The Docs](https://http-signatures-php.readthedocs.io/en/latest/) Contributing ------------ [](#contributing) Pull Requests are welcome, as are [issue reports](https://github.com/liamdennehy/http-signatures-php/issues) if you encounter any problems. **Note**: Due to composer dependencies for the reference implementation `composer install` prior to local development is only posible on PHP 7.1, or by manually removing the incompatible dependencies using the command (wrapped for readability): ``` composer remove --dev \ nyholm/psr7 nyholm/psr7-server riswallsmith/buzz \ endframework/zend-httphandlerrunner ``` License ------- [](#license) HTTP Signatures PHP library is licensed under [The MIT License (MIT)](https://opensource.org/licenses/MIT). Documentation of the library is licensed under [Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)](https://creativecommons.org/licenses/by-sa/4.0/) Details are in the [LICENSE file](./LICENSE.md) ### Health Score 37 — LowBetter than 83% of packages Maintenance41 Moderate activity, may be stable Popularity20 Limited adoption so far Community17 Small or concentrated contributor base Maturity61 Established project with proven stability Bus Factor1 Top contributor holds 71.2% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~169 days Total 4 Last Release 489d ago Major Versions 1.0.0 → 2.0.02025-01-13 PHP version history (2 changes)1.0.0PHP >=5.6 2.0.0PHP >=8.3 ### Community Maintainers ![](https://avatars.githubusercontent.com/u/81697853?v=4)[SaGa Corp](/maintainers/sagacorp)[@sagacorp](https://github.com/sagacorp) --- Top Contributors [![liamdennehy](https://avatars.githubusercontent.com/u/4996358?v=4)](https://github.com/liamdennehy "liamdennehy (282 commits)")[![pda](https://avatars.githubusercontent.com/u/15759?v=4)](https://github.com/pda "pda (54 commits)")[![navitronic](https://avatars.githubusercontent.com/u/180519?v=4)](https://github.com/navitronic "navitronic (24 commits)")[![mtibben](https://avatars.githubusercontent.com/u/980499?v=4)](https://github.com/mtibben "mtibben (16 commits)")[![vinkla](https://avatars.githubusercontent.com/u/499192?v=4)](https://github.com/vinkla "vinkla (6 commits)")[![rubensayshi](https://avatars.githubusercontent.com/u/649160?v=4)](https://github.com/rubensayshi "rubensayshi (5 commits)")[![achretien](https://avatars.githubusercontent.com/u/5468508?v=4)](https://github.com/achretien "achretien (4 commits)")[![feenx](https://avatars.githubusercontent.com/u/9256168?v=4)](https://github.com/feenx "feenx (1 commits)")[![harto](https://avatars.githubusercontent.com/u/103448?v=4)](https://github.com/harto "harto (1 commits)")[![vektah](https://avatars.githubusercontent.com/u/2247982?v=4)](https://github.com/vektah "vektah (1 commits)")[![AdrienHt](https://avatars.githubusercontent.com/u/16516183?v=4)](https://github.com/AdrienHt "AdrienHt (1 commits)")[![hannesvdvreken](https://avatars.githubusercontent.com/u/1410358?v=4)](https://github.com/hannesvdvreken "hannesvdvreken (1 commits)") --- Tags httphttpssignaturesigningrsahmacdigital-signaturesignedelectronic signature ### Code Quality TestsPHPUnit Code StylePHP CS Fixer ### Embed Badge ![Health badge](/badges/sagacorp-http-signatures-php/health.svg) ``` [![Health](https://phpackages.com/badges/sagacorp-http-signatures-php/health.svg)](https://phpackages.com/packages/sagacorp-http-signatures-php) ``` ### Alternatives [99designs/http-signatures Sign and verify HTTP messages 47769.4k6](/packages/99designs-http-signatures)[guzzlehttp/psr7 PSR-7 message implementation that also provides common utility methods 7.9k1.0B3.2k](/packages/guzzlehttp-psr7)[league/uri-interfaces Common tools for parsing and resolving RFC3987/RFC3986 URI 536204.9M23](/packages/league-uri-interfaces)[99designs/http-signatures-guzzlehttp Sign and verify HTTP messages with Guzzle 6 13204.5k5](/packages/99designs-http-signatures-guzzlehttp)[league/uri URI manipulation library 1.1k206.4M277](/packages/league-uri)[react/http Event-driven, streaming HTTP client and server implementation for ReactPHP 78026.4M414](/packages/react-http) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)