<titledata-react-helmet="true">Request Signatures | OAuth2 Proxy</title><metadata-react-helmet="true"name="twitter:card"content="summary_large_image"><metadata-react-helmet="true"property="og:url"content="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures"><metadata-react-helmet="true"name="docusaurus_locale"content="en"><metadata-react-helmet="true"name="docusaurus_version"content="7.0.x"><metadata-react-helmet="true"name="docusaurus_tag"content="docs-default-7.0.x"><metadata-react-helmet="true"property="og:title"content="Request Signatures | OAuth2 Proxy"><metadata-react-helmet="true"name="description"content="If signature_key is defined, proxied requests will be signed with the"><metadata-react-helmet="true"property="og:description"content="If signature_key is defined, proxied requests will be signed with the"><linkdata-react-helmet="true"rel="icon"href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><linkdata-react-helmet="true"rel="canonical"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures"><linkdata-react-helmet="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures"hreflang="en"><linkdata-react-helmet="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/7.0.x/features/request_signatures"hreflang="x-default"><linkrel="stylesheet"href="/oauth2-proxy/assets/css/styles.19258e03.css">
<code>GAP-Signature</code> header, which is a <ahref="https://en.wikipedia.org/wiki/Hash-based_message_authentication_code"target="_blank"rel="noopener noreferrer">Hash-based Message Authentication Code
(HMAC)</a>
of selected request information and the request body <ahref="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go"target="_blank"rel="noopener noreferrer">see <code>SIGNATURE_HEADERS</code>
in <code>oauthproxy.go</code></a>.</p><p><code>signature_key</code> must be of the form <code>algorithm:secretkey</code>, (ie: <code>signature_key = "sha1:secret0"</code>)</p><p>For more information about HMAC request signature validation, read the
following:</p><ul><li><ahref="https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html"target="_blank"rel="noopener noreferrer">Amazon Web Services: Signing and Authenticating REST
Requests</a></li><li><ahref="http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/"target="_blank"rel="noopener noreferrer">rc3.org: Using HMAC to authenticate Web service