AWS SigV4 request signer

Sign an HTTP request with AWS Signature Version 4 locally in your browser. The 29.72 kB QIP component outputs the headers to add to the request. It never sends the request, and your keys never leave this page.

The form starts with the AWS SigV4 test suite's get-vanilla example, which signs to 5fa00fa3…3fbf31.

Request to sign

Method Time (UTC)

URL

Region Service

Access key ID Secret access key Session token (optional) Body (optional)

Output: signed headers Updates as you type. Add these headers to your HTTP request.

AWS rejects signatures more than about 15 minutes from its own clock, so press Now before signing a real request. A component can't read the clock, so the same inputs always give the same signature.

The URL's path and query must already be percent-encoded. + is a literal plus, so write spaces as %20. The Host header the request sends must match the URL's host. For S3 services the signed headers include X-Amz-Content-Sha256; other services only fold the body hash into the signature.

Not supported yet: presigned URLs, signing extra headers, and inferring the region or service from the host.

Download #

aws-sigv4-sign.wasm — 29.72 kB

CLI equivalent #

qip run \
  -F method=GET \
  -F url='https://example.amazonaws.com/' \
  -F region=us-east-1 -F service=service \
  -F access_key_id=AKIDEXAMPLE \
  -F secret_access_key='wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY' \
  multipart/form-data/aws-sigv4-sign.wasm -u timestamp=1440938160