sagacorp / http-signatures-php

3.0.0 2026-09-30 08:30 UTC

Requires

• php: >=8.3
• phpseclib/phpseclib: ^3.0 || ^4.0.1
• psr/http-message: ^1.0 || ^2.0

Requires (Dev)

• friendsofphp/php-cs-fixer: ^3.64
• guzzlehttp/psr7: ^2.7 || ^3.0
• php-http/discovery: ^1.20
• phpunit/phpunit: ^11.5 || ^12.0 || ^13.0
• symfony/http-foundation: ^7.2.2 || ^8.0
• symfony/psr-http-message-bridge: ^7.2.0 || ^8.0

MIT

• Liam Dennehy
• Paul Annesley

• http
• https
• signature
• signing
• rsa
• hmac
• signed
• digital signature
• electronic signature

Published on Packagist.org on 2026-09-30 08:34 UTC

README

PHP implementation of Signing HTTP Messages draft specification; allowing cryptographic signing and verifying of PSR-7 messages.

Features

• Sign HTTP Messages according to Signing HTTP Message draft IETF RFC version 10
• Sign & verify messages using HMACs
• Sign & verify messages with Asymmetric Keys:
  • RSA, DSA, EC
• Add a Digest header, or automatically add the header while signing in a single operation
• Verify a Digest header while verifying the signature

Complete documentation for this library can be found at Read The Docs

Requirements

• PHP 8.3 or later
• phpseclib 3 or 4, for all cryptographic operations

Both phpseclib major versions are supported; Composer will resolve whichever one suits the rest of your project. They expose the same classes under different namespaces, so the library aliases the installed one internally and its own public API is identical either way.

Simple Usage

Add sagacorp/http-signatures-php to your composer.json.

• A message is assumed to be a PSR-7 compatible Request or Response.
• A Context object is used to configure the signature parameters, and prepare the verifier functionality.
• The signWithDigest function witll add a Digest header and digitally sign the message in a new Signature header.

Signing a PSR-7 request $message before sending:

  use HttpSignatures\Context;

  $context = new HttpSignatures\Context([
    'keys' => ['mykey' => file_get_contents('/path/to/privatekeyfile')],
    'algorithm' => 'rsa-sha256',
    'headers' => ['(request-target)', 'Date'],
  ]);

  $context->signer()->signWithDigest($message);

Complete documentation for this library for other ose cases can be found at Read The Docs

Contributing

Pull Requests are welcome, as are issue reports if you encounter any problems.

Note: Due to composer dependencies for the reference implementation composer install prior to local development is only posible on PHP 7.1, or by manually removing the incompatible dependencies using the command (wrapped for readability):

  composer remove --dev \
  nyholm/psr7 nyholm/psr7-server riswallsmith/buzz \
  endframework/zend-httphandlerrunner

License

HTTP Signatures PHP library is licensed under The MIT License (MIT).

Documentation of the library is licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)

Details are in the LICENSE file