# AWS Signature V4 Signer

Generate AWS SigV4 canonical requests, strings to sign, signatures, and Authorization headers locally for S3, IAM, and AWS APIs.

## Run it

- **CLI:** `gizza tool aws-sigv4-signer "https://examplebucket.s3.amazonaws.com/test.txt" 'region=us-east-1' 'service=s3' 'access_key=AKIAIOSFODNN7EXAMPLE' 'secret_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'`
- **Web:** https://gizza.ai/tools/aws-sigv4-signer/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/aws-sigv4-signer/tool.json

## Inputs

- `url` — Request URL _(field)_
- `region` — Region _(field)_
- `service` — Service _(field)_
- `access_key` — Access key ID _(field)_
- `secret_key` — Secret access key _(field)_
- `method` — HTTP method _(field)_
- `session_token` — Session token (optional) _(field)_
- `payload` — Request body / payload _(field)_
- `headers` — Extra headers (one Name: Value per line) _(field)_
- `amz_date` — Timestamp (blank = now) _(field)_
- `unsigned_payload` — Unsigned payload (UNSIGNED-PAYLOAD) _(field)_
- `sign_content_sha256` — Add x-amz-content-sha256 (S3) _(field)_
- `output` — Output _(field)_

## Output

- SigV4 result (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `url` — Request URL
- `region` — Region
- `service` — Service
- `access_key` — Access key ID
- `secret_key` — Secret access key
- `method` — HTTP method
- `session_token` — Session token (optional)
- `payload` — Request body / payload
- `headers` — Extra headers (one Name: Value per line)
- `amz_date` — Timestamp (blank = now)
- `unsigned_payload` — Unsigned payload (UNSIGNED-PAYLOAD)
- `sign_content_sha256` — Add x-amz-content-sha256 (S3)
- `output` — Output

Example: `https://gizza.ai/tools/aws-sigv4-signer/?url=https%3A%2F%2Fexamplebucket.s3.amazonaws.com%2Ftest.txt&region=us-east-1&service=s3&access_key=AKIAIOSFODNN7EXAMPLE&secret_key=wJalrXUtnFEMI%2FK7MDENG%2FbPxRfiCYEXAMPLEKEY&method=GET&session_token=STS%20temporary-credential%20token%2C%20or%20leave%20blank&payload=Leave%20blank%20for%20GET%2FHEAD&headers=content-type%3A%20application%2Fjson&amz_date=20150830T123600Z&unsigned_payload=true&sign_content_sha256=true&output=all`

---

## About this tool

AWS Signature Version 4 turns a request into a deterministic HMAC-SHA256 signature. This tool builds the same pieces AWS verifies on the server side: the canonical request, string to sign, credential scope, hexadecimal signature, Authorization header, and optional cURL command.

Use it when you are debugging S3, IAM, API Gateway, DynamoDB, or another AWS API call and need to compare each SigV4 step against your application. Enter the full request URL, region, service code, access key ID, secret key, and any headers or payload you will send. Leave the timestamp blank for the current UTC time, or provide a fixed `YYYYMMDDTHHMMSSZ` value to reproduce a known AWS documentation vector.

The calculation runs locally in the page. The secret key is used only to derive the signing key and is never printed in the result. For temporary credentials, paste the STS session token so the tool includes and signs `x-amz-security-token`.

Example: sign the AWS IAM ListUsers request with the documentation credentials, `GET`, region `us-east-1`, service `iam`, URL `https://iam.amazonaws.com/?Action=ListUsers&Version=2010-05-08`, header `content-type: application/x-www-form-urlencoded; charset=utf-8`, and timestamp `20150830T123600Z`. Choosing `signature` returns `5d672d79c15b13162d9279b0855cfba6789a8edb4c82c400e06b5924a6f2b5d7`.

Limitations: this is header-based SigV4 (`AWS4-HMAC-SHA256`). It does not create presigned URLs or SigV4a ECDSA signatures, and it does not send the request for you.

## FAQ

<details>
<summary>Does this send my AWS secret key anywhere?</summary>

No. The page computes the HMAC-SHA256 signing key locally and never includes the secret key in the output. The Authorization header contains the access key ID, date scope, signed header list, and signature, but not the secret key.

</details>

<details>
<summary>What should I put in the service field?</summary>

Use the AWS service signing name, such as `s3`, `iam`, `execute-api`, `dynamodb`, or `ec2`. The service string becomes part of the credential scope and signing key, so it must match the API endpoint you are calling.

</details>

<details>
<summary>When should I enable unsigned payload or x-amz-content-sha256?</summary>

`unsigned_payload` signs the literal `UNSIGNED-PAYLOAD`, which is common for S3 streaming or browser-style uploads. `sign_content_sha256` adds and signs the `x-amz-content-sha256` header; S3 often requires it. For most JSON API calls, leave both off and sign the actual payload hash.

</details>

<details>
<summary>Can this make a presigned S3 URL?</summary>

No. Presigned URLs use query-string authentication with additional parameters and expiration handling. This tool focuses on header-based SigV4 requests and exposes the canonical request/string-to-sign so you can debug normal Authorization-header signing.

</details>

## Related tools

- [Fernet token tool](https://gizza.ai/tools/fernet-token/): Create and read Fernet tokens (AES-128-CBC + HMAC-SHA256) in your browser: generate a key, encrypt to a url-safe token, decrypt with optional TTL. No upload.
- [HMAC Generator](https://gizza.ai/tools/hmac-generate/): Generate an HMAC of any message and secret key in your browser — HMAC-SHA256, SHA-1, SHA-512, SHA-3 or MD5, hex or base64 output. Free and private.
- [AES cipher](https://gizza.ai/tools/aes-cipher/): Encrypt or decrypt text with AES in CBC, CTR, GCM or ECB mode and 128/192/256-bit keys, with hex/base64 I/O — in your browser. Nothing is uploaded.
- [AES Key Wrap](https://gizza.ai/tools/aes-key-wrap/): Wrap and unwrap cryptographic keys with AES Key Wrap (KW / RFC 3394, KWP / RFC 5649) using a 128/192/256-bit KEK — hex or base64, free and in-browser.
- [Argon2 hash](https://gizza.ai/tools/argon2-hash/): Hash a password with Argon2id (configurable memory, iterations, parallelism) and get a PHC string, or verify a password — in your browser. Nothing is uploaded.