How do I install the API Request Signing skill?

Run npx skillmds@latest add deangrant/api-request-signing in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is API Request Signing safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with API Request Signing?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is API Request Signing free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published API Request Signing?

deangrant (@deangrant) published this skill. Their other Agent Skills are listed on their SkillMD profile.

API Request Signing

Name: API Request Signing
Author: deangrant

Design HTTP request signing for APIs: HMAC, SigV4-style, RFC 9421 signatures, Content-Digest, and replay defenses. Use when securing webhooks, payments, or high-assurance service calls.

deangrant 48b774f 4 files · 1.8 KB Updated Sep 17, 2026

Integrations & APIs

Install

Press C to copy

$ npx skillmds@latest add deangrant/api-request-signing

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download .zip

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/deangrant/api-request-signing.svg)](https://skillmd.com/skills/deangrant/api-request-signing)

Trust & safety

Audits pending

Not yet audited · commit 48b774f

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Request Signing

Use this skill when Bearer tokens alone are insufficient — payments, webhooks, or high-assurance S2S.

1. Approaches

Approach	Notes
HMAC over canonical string	Common for webhooks
Cloud SigV4-style	Scoped credentials, signed headers
RFC 9421 HTTP Message Signatures	Standardized header signatures
Content-Digest	Integrity of body (RFC 9530)

2. Replay defense

Include timestamp and/or nonce; reject skew outside window; constant-time compare; sign method+path+body digest+timestamp.

3. Quick checklist

Canonicalization documented and tested.
Timestamp/nonce replay window.
Constant-time signature compare.
Key rotation supported.
Body digest covered when body matters.

See reference.md and examples.md.

deangrant/agents/tree/main/.agents/skills/api-request-signing commit 48b774f5a5

Frequently asked questions

npx skillmds@latest add deangrant/api-request-signing