PHPackages                             skillmonster/http-message-signature - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. skillmonster/http-message-signature

ActiveLibrary[HTTP & Networking](/categories/http)

skillmonster/http-message-signature
===================================

PHP implementation of RFC 9421 HTTP Message Signatures

03PHPCI failing

Since Oct 23Pushed 6mo agoCompare

[ Source](https://github.com/skillmonster/http-message-signature)[ Packagist](https://packagist.org/packages/skillmonster/http-message-signature)[ RSS](/packages/skillmonster-http-message-signature/feed)WikiDiscussions main Synced 1mo ago

READMEChangelogDependenciesVersions (1)Used By (0)

HTTP Message Signatures for PHP
===============================

[](#http-message-signatures-for-php)

[![PHP Version](https://camo.githubusercontent.com/7663c9d53dc13cedaf0660a8745a7e77d2dd711257f36aa86ebce12a0600ef42/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7068702d253345253344382e312d626c75652e737667)](https://php.net/)[![License](https://camo.githubusercontent.com/8bb50fd2278f18fc326bf71f6e88ca8f884f72f179d3e555e20ed30157190d0d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d677265656e2e737667)](LICENSE)

A complete PHP implementation of [RFC 9421: HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421.html), providing cryptographic signing and verification of HTTP messages.

Features
--------

[](#features)

- ✅ **Full RFC 9421 Compliance** - Complete implementation of the HTTP Message Signatures standard
- 🔐 **Multiple Algorithms** - Support for RSA-PSS-SHA512, RSA-PKCS1-v1.5-SHA256, ECDSA-P256-SHA256, HMAC-SHA256, and Ed25519
- 📦 **PSR-7 Compatible** - Works with any PSR-7 HTTP message implementation
- 🎯 **Derived Components** - Support for `@method`, `@target-uri`, `@authority`, `@path`, `@query`, `@status`, and more
- 🔄 **Multiple Signatures** - Add multiple signatures to a single message
- 🔑 **Flexible Key Formats** - Supports PEM, DER, base64, and raw key formats
- 🛡️ **Content Digest** - SHA-512 content digest support for body integrity
- 🎲 **Nonce Support** - Built-in random nonce generation for replay protection
- 🏷️ **Tag Parameter** - Application-specific tag support
- ⚡ **Easy to Use** - Simple, intuitive API
- 🧪 **Well Tested** - Comprehensive test suite
- 📝 **Type Safe** - Full PHP 8.1+ type declarations
- 🚀 **Production Ready** - Battle-tested with real-world APIs

Installation
------------

[](#installation)

Install via Composer:

```
composer require skillmonster/http-message-signature
```

### Requirements

[](#requirements)

- PHP 8.1 or higher
- OpenSSL extension
- JSON extension
- Sodium extension (for Ed25519 support, included in PHP 7.2+)
- PSR-7 HTTP Message implementation (e.g., `guzzlehttp/psr7`)

Quick Start
-----------

[](#quick-start)

### Basic HMAC Signature

[](#basic-hmac-signature)

```