kinetis / aws-sigv4

v1.3.2 2026-09-13 11:01 UTC

Requires

• php: ^8.4
• amphp/http-client: ^5.3.6
• async-aws/core: ^1.29.2
• kinetis/revolt-http-client: ^1.4.1
• nyholm/psr7: ^1.8.2
• psr/http-client: ^1.0.3
• psr/http-message: ^2.0
• symfony/http-client: ^8.1.4
• symfony/http-client-contracts: ^3.7.1

Requires (Dev)

• infection/infection: ^0.35.0
• kinetis/framework: ^1.8.1
• phpstan/phpstan: ^2.2.8
• phpunit/phpunit: ^13.3.3
• vimeo/psalm: ^6.17

MIT

• Alon Noy

Published on Packagist.org on 2026-09-13 11:14 UTC

README

kinetis/aws-sigv4
A PSR-18 client that signs requests with AWS Signature Version 4

Part of Kinetis, a non-blocking PHP framework for API-first applications, developed in the kinetis-dev/kinetis monorepo.

A PSR-18 HTTP client that signs every outgoing request with AWS Signature Version 4 (SigV4) and sends it to one configured origin, checked against AWS's own published SigV4 test vectors. Usable outside Kinetis entirely, the same relationship kinetis/revolt-http-client already has with the wider PHP ecosystem.

use Kinetis\AwsSigV4\SigV4SigningClient;

$signedClient = new SigV4SigningClient(
    origin: 'https://search-my-domain.us-east-1.es.amazonaws.com',
    region: 'us-east-1',
    service: 'es', // Amazon OpenSearch Service's signing name
);

$response = $signedClient->sendRequest($request);

$origin is the only scheme, host, and port this client will sign for, with an optional path prefix that binds every request. A relative request resolves against it; anything else — another host, another port, an http target under an https origin, a path that leaves the prefix — is rejected before credentials are resolved, before the body is read, and before the network is touched. The target is put into the exact form it will be sent in before both the check and the signature, so the signature covers the bytes that go out. A 3xx response is returned as it is: nothing is re-signed and no Location is followed, for the signed request or for the credential lookups. Signing reads the request body once, from where it stands, and consumes it. A request is bounded at 30 seconds idle and 30 seconds end to end, each settable on its own through SignedTransport::create().

$service is the AWS signing service name ("es" for Amazon OpenSearch Service, "execute-api" for API Gateway, and so on) — required, with no default, since guessing wrong produces a signature that fails verification rather than an obvious error.

Credentials

Resolved through AsyncAws's five providers in their standard order (environment variables, including the STS assume-role AWS_ROLE_ARN selects; web identity; the shared credentials and config files; ECS or EKS pod identity; IMDS) unless a CredentialProvider is passed as the fourth constructor argument. Every provider in it that calls AWS uses the same SignedTransport the signed request travels on; the shared credentials and config files and any token file are read with native blocking calls. The first unexpired credentials are held until they expire, and a lookup that resolves nothing holds nothing.

Installation

composer require kinetis/aws-sigv4

Requires PHP 8.4+ and kinetis/revolt-http-client. Full documentation, including the origin grammar, deadlines, failure behavior, and what is buffered or blocking: kinetis.dev/docs/aws-sigv4.html.

License

MIT — see LICENSE.