CURLOPT_HTTPSIG_HEADERS(3)                            Library Functions Manual

NAME
       CURLOPT_HTTPSIG_HEADERS - components to sign for HTTP Message
       Signatures

SYNOPSIS
       #include <curl/curl.h>

       CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPSIG_HEADERS,
                                 char *components);

DESCRIPTION
       This feature is experimental and may change before it is considered
       stable. We advise against using it in production.

       Pass a space-separated list of component identifiers to include in the
       RFC 9421 HTTP Message Signature.

       Derived components are given as bare names:

       - method - the HTTP method (GET, POST, etc.)  - authority - the host
       and optional port - path - the request path - query - the query string
       including the leading ?

       HTTP header fields are given with a trailing colon, for example
       content-type: or content-digest:. This mirrors how a header looks and
       keeps a leading @ free for its usual curl meaning (read the value from
       a file).

       If this option is not set, the default components are method,
       authority, path (plus query when a query string is present).

       Signing request headers
              Header components are resolved from the list set with
              CURLOPT_HTTPHEADER(3) only. Headers that libcurl adds later
              (such as the default User-Agent) are not visible to the signer
              unless the application supplies them explicitly.

              To sign User-Agent, supply it via CURLOPT_HTTPHEADER(3) together
              with this option before the transfer; see EXAMPLE.

              Each component identifier may appear at most once (RFC 9421
              Section 2).  Listing the same component twice returns
              CURLE_BAD_FUNCTION_ARGUMENT.

              At most 16 components are accepted; supplying more returns
              CURLE_BAD_FUNCTION_ARGUMENT.

              The application does not have to keep the string around after
              setting this option.

DEFAULT
       NULL (uses the default component set)

PROTOCOLS
       This functionality affects http only

EXAMPLE
       int main(void)
       {
         CURL *curl = curl_easy_init();
         struct curl_slist *headers = NULL;

         if(curl) {
           headers = curl_slist_append(headers, "User-Agent: MyApp/1.0");
           curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
           curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api");
           curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM, CURLHTTPSIG_ED25519);
           curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY,
                            "9f8362f87a484a954e6e740c5b4c0e84"
                            "229139a20aa8ab56ff66586f6a7d29c5");
           curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEYID, "my-key-id");
           curl_easy_setopt(curl, CURLOPT_HTTPSIG_HEADERS,
                            "method authority path content-type: user-agent:");
           curl_easy_perform(curl);
           curl_slist_free_all(headers);
         }
       }

AVAILABILITY
       Added in curl 8.22.0

RETURN VALUE
       curl_easy_setopt(3) returns a CURLcode indicating success or error.

       CURLE_OK (0) means everything was OK, non-zero means an error occurred,
       see libcurl-errors(3).

SEE ALSO
       CURLOPT_HTTPSIG_ALGORITHM(3), CURLOPT_HTTPSIG_KEY(3),
       CURLOPT_HTTPSIG_KEYID(3)

libcurl                           2026-09-02        CURLOPT_HTTPSIG_HEADERS(3)