CURLOPT_HTTPSIG_ALGORITHM(3)

📦
version 8.23.0 · 3 versions
, in alpine 3.23, alpine 3.24

💅 CURLOPT_HTTPSIG_ALGORITHM(3) — like, the whole manual page, bestie

okay so real talk, this page lives in the Library Functions Manual section, and it's about CURLOPT_HTTPSIG_ALGORITHM — RFC 9421 HTTP Message Signatures algorithm ✨ iykyk

🌸 NAME 🌸

CURLOPT_HTTPSIG_ALGORITHM — RFC 9421 HTTP Message Signatures algorithm 🎀

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPSIG_ALGORITHM,
                          long algorithm);

💖 DESCRIPTION 💖

🚨 bestie this feature is experimental and may change before it is considered stable. We advise against using it in production. no cap, please don't ship it to prod yet 😭

So what it does: it enables RFC 9421 HTTP Message Signatures on your outgoing requests 🔥 You pass a long set to one of the values below to pick which signing algorithm you want.

  • CURLHTTPSIG_NONE (0) — turns HTTP Message Signatures all the way off, like closing the app 🙈
  • CURLHTTPSIG_ED25519 (1) — signs with Ed25519 (RFC 8032). Heads up: this one requires a TLS backend with Ed25519 support 💀
  • CURLHTTPSIG_HMAC_SHA256 (2) — signs with HMAC-SHA256, the classic, the icon 👑

also, gossip drop: setting this option to a non-zero value also sets CURLOPT_HTTPAUTH(3) to CURLAUTH_HTTPSIG. And the options CURLOPT_HTTPSIG_KEY(3) and CURLOPT_HTTPSIG_KEYID(3) must also be set — no key, no keyid, no signing, periodt 🫶

🎀 DEFAULT 🎀

CURLHTTPSIG_NONE (0)

like, out of the box it's off. main character energy is opt-in 💅

🦋 PROTOCOLS 🦋

This functionality affects http only. that's it. that's the list. 🌈

⭐ EXAMPLE ⭐

int main(void)
{
  CURL *curl = curl_easy_init();

  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api");
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519);
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY,
                     "9f8362f87a484a954e6e740c5b4c0e84"
                     "229139a20aa8ab56ff66586f6a7d29c5");
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEYID, "my-key-id");
    curl_easy_perform(curl);
  }
}

look at her go 💜 URL, algorithm, key, keyid, perform — that's the whole slay sequence.

🌸 AVAILABILITY 🌸

Added in curl 8.22.0 — so if your curl is older, this option literally does not exist for you, sorry babe 🫶

💀 RETURN VALUE 💀

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK — ate, no crumbs ✨ non-zero means an error occurred, so go check libcurl-errors(3) and find out what went wrong 😭

👑 SEE ALSO 👑

okay that's the whole page, go read those siblings for the full lore 🦋

mwah 💋 this was brought to you by libcurl, dated 2026-10-25, filed under CURLOPT_HT...G_ALGORITHM(3) because even the header ran out of room for the full name 😭 stay signed, stay iconic 🎀

📦 where this page comes from