How do I sign an HTTP request with RFC 9421?

To sign an HTTP request with RFC 9421, you define which parts of the request (headers, method, path) are covered, construct a signature base string, add a Signature-Input header listing those components, and attach the actual signature in a Signature header. The free AlgoVoi RFC 9421 verifier checks the result offline, ensuring your signature complies with the standard.

RFC 9421 (HTTP Message Signatures) gives you a standard way to prove a request came from a specific key holder. It works for APIs, agentic workflows, and compliance logs. Below is the concrete process, grounded in the spec and verified by the open-source tooling.

Choose the covered components

First, decide which parts of the request must be signed. Common choices are: - @method (the HTTP verb, e.g., GET or POST) - @target-uri (the full request URI) - content-digest (the RFC 9530 digest of the body) - authorization (if present) - date (the Date header)

List these in a Signature-Input header. The header value is a dictionary of signature labels. Each label maps to a list of covered components and parameters. Example:

Signature-Input: sig1=("@method" "@target-uri" "content-digest" "date");created=1711238400;keyid="ed25519-key-1"

The created parameter is a Unix timestamp. The keyid identifies the public key that verifies the signature.

Build the signature base

The signature base is a canonical string that represents the covered components. Each component is serialized as:

"@method": GET
"@target-uri": https://api.algovoi.co.uk/resource
"content-digest": sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:
"date": Tue, 23 Apr 2024 00:00:00 GMT

Concatenate these lines with newlines. The exact rules are in RFC 9421, section 2.4. The free AlgoVoi verifier follows these rules byte-for-byte.

Set the Signature-Input and Signature headers

Add the Signature-Input header you built above. Then compute the signature over the base string using your private key. For Ed25519, the signature is 64 bytes. Encode it in base64 and add it in a Signature header:

Signature: sig1=:KX3V4yV5... (base64 signature):

The label sig1 matches the label in Signature-Input.

Sign with Ed25519 (or ECDSA-P256, RSA-PSS)

RFC 9421 supports multiple algorithms. The free AlgoVoi verifier supports Ed25519 today. ECDSA-P256 and RSA-PSS are on the roadmap. Use the algorithm that matches your key material.

Verify with the free AlgoVoi verifier

After signing, verify the request with the open-source algovoi-rfc9421-verifier (Apache-2.0). Install it with:

pip install algovoi-rfc9421-verifier

npm install @algovoi/rfc9421-verifier

The verifier checks the signature base, the Signature-Input header, and the Signature header. It reports success or failure, with no AlgoVoi dependency in the trust path.

Do it with AlgoVoi

AlgoVoi provides the free, open-source algovoi-rfc9421-verifier (v0.4.4). It is the reference implementation for RFC 9421 and RFC 9530. Python and TypeScript versions have byte-for-byte parity. Use it to verify your signatures offline, or test against the hosted verifier at verify.algovoi.co.uk/rfc9421.

Start with the docs: https://docs.algovoi.co.uk/quickstart