# API Request Signing

> Design HTTP request signing for APIs: HMAC, SigV4-style, RFC 9421 signatures, Content-Digest, and replay defenses. Use when securing webhooks, payments, or high-assurance service calls.

- Skill: `deangrant/api-request-signing` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add deangrant/api-request-signing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/deangrant/api-request-signing/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: deangrant (https://skillmd.com/u/deangrant)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/deangrant/api-request-signing

---


# Request Signing

Use this skill when Bearer tokens alone are insufficient — payments, webhooks,
or high-assurance S2S.

---

## 1. Approaches

| Approach | Notes |
| -------- | ----- |
| HMAC over canonical string | Common for webhooks |
| Cloud SigV4-style | Scoped credentials, signed headers |
| RFC 9421 HTTP Message Signatures | Standardized header signatures |
| Content-Digest | Integrity of body (RFC 9530) |

---

## 2. Replay defense

Include timestamp and/or nonce; reject skew outside window; constant-time
compare; sign method+path+body digest+timestamp.

---

## 3. Quick checklist

- [ ] Canonicalization documented and tested.
- [ ] Timestamp/nonce replay window.
- [ ] Constant-time signature compare.
- [ ] Key rotation supported.
- [ ] Body digest covered when body matters.

See [reference.md](reference.md) and [examples.md](examples.md).