CURLOPT_HTTPSIG_HEADERS(3)

CURLOPT_HTTPSIG_HEADERS(3) 💅✨

okay bestie, welcome to the Library Functions Manual entry for CURLOPT_HTTPSIG_HEADERS — it’s literally the glow-up for telling curl which components go into an HTTP Message Signature. no cap. 🫶

✨ NAME ✨

CURLOPT_HTTPSIG_HEADERS — components to sign for HTTP Message Signatures 💖

🦋 SYNOPSIS 🦋

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPSIG_HEADERS,
                          char *components);

💅 DESCRIPTION 💅

okay so first thing: this feature is experimental and may change before it is considered stable. We advise against using it in production. like, she’s gorgeous but she’s still in beta, bestie. 😭

You pass a space-separated list of component identifiers to include in the RFC 9421 HTTP Message Signature. periodt.

Derived components are given as bare names:

• method — the HTTP method (GET, POST, etc.)
• authority — the host and optional port
• path — the request path
• query — the query string including the leading ?

HTTP header fields are given with a trailing colon, for example content-type: or content-digest:. This mirrors how a header looks and keeps a leading @ free for its usual curl meaning (read the value from a file). iconic behavior, honestly. 🎀

If this option is not set, the default components are method, authority, path (plus query when a query string is present).

🫶 Signing request headers 🫶

Header components are resolved from the list set with CURLOPT_HTTPHEADER(3) only. Headers that libcurl adds later (such as the default User-Agent) are not visible to the signer unless the application supplies them explicitly.

To sign User-Agent, supply it via CURLOPT_HTTPHEADER(3) together with this option before the transfer; see EXAMPLE.

Each component identifier may appear at most once (RFC 9421 Section 2). Listing the same component twice returns CURLE_BAD_FUNCTION_ARGUMENT. no duplicates, babes — she said what she said. 💀

At most 16 components are accepted; supplying more returns CURLE_BAD_FUNCTION_ARGUMENT.

The application does not have to keep the string around after setting this option. set it and forget it, lowkey. ✨

🎀 DEFAULT 🎀

NULL (uses the default component set) 🌸

🌈 PROTOCOLS 🌈

This functionality affects http only. 🦋

🍓 EXAMPLE 🍓

int main(void)
{
  CURL *curl = curl_easy_init();
  struct curl_slist *headers = NULL;

  if(curl) {
    headers = curl_slist_append(headers, "User-Agent: MyApp/1.0");
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api");
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519);
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY,
                     "9f8362f87a484a954e6e740c5b4c0e84"
                     "229139a20aa8ab56ff66586f6a7d29c5");
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEYID, "my-key-id");
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_HEADERS,
                     "method authority path content-type: user-agent:");
    curl_easy_perform(curl);
    curl_slist_free_all(headers);
  }
}

⭐ AVAILABILITY ⭐

Added in curl 8.22.0. she’s new here, be nice. 👑

💜 RETURN VALUE 💜

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK, non-zero means an error occurred, see libcurl-errors(3). slay when it’s zero, check the error code when it’s not. 🔥

🔥 SEE ALSO 🔥

• CURLOPT_HTTPSIG_ALGORITHM(3)
• CURLOPT_HTTPSIG_KEY(3)
• CURLOPT_HTTPSIG_KEYID(3)

---

xoxo, libcurl — page CURLOPT_HTTPSIG_HEADERS(3), dated 2026-10-25 🎀💖