Signing without a full SDK
Build requests with plain http types, sign them in place, and send with any client. Encoded URIs, atomic request mutation, and expiration follow explicit, documented contracts.
Apache Reqsign™ — Request Signing
Build. Sign. Send.
Sign HTTP requests, load cloud credentials, and grant scoped access — without pulling in a full vendor SDK.
9signing providers
5granting operations
5WASM-ready providers
0vendor SDKs required
$ cargo add reqsign --features aws
use reqsign::aws;
// Create a default signer for S3 in us-east-1
let signer = aws::default_signer("s3", "us-east-1");
// Build a request
let mut req = http::Request::builder()
.method(http::Method::GET)
.uri("https://s3.amazonaws.com/my-bucket/my-object")
.body(())
.unwrap()
.into_parts()
.0;
// Sign the request
signer.sign(&mut req, None).await?;
Proven in production
Apache OpenDAL™ signs every cloud storage request — S3, GCS, Azure Blob, COS, TOS, and more — through Reqsign.
uv the Python package manager, authenticates to AWS, Azure, and Google Cloud with Reqsign.
Why Reqsign
The signing layer, and nothing else.
Reqsign keeps each provider's protocol explicit while sharing one composition pattern — so your client stays yours.
Credentials that fit the provider
Every provider keeps its own credential semantics. Default chains cover environment, config files, instance metadata, OIDC federation, CLIs, and credential processes.
Scoped access you can grant
One Granter abstraction covers S3 Access Grants, S3 Express sessions, Azure user delegation SAS, and GCP Credential Access Boundary — downscoping that vendor SDKs rarely unify.
A runtime you control
Context makes file reading, HTTP sending, environment, and command execution pluggable. Swap Tokio and reqwest for your own runtime, or compile to WebAssembly.
How it works
Three steps. Your client stays in charge.
- 01
Build
Construct the request with the http crate's plain types — reqsign never wraps your HTTP client.
- 02
Load or grant
Resolve credentials through the provider's default chain, your own ProvideCredential, or a Granter that downscopes them first.
- 03
Sign, then send
One sign call mutates the request head atomically — headers or query string — and hands it back for any client to send.
Capabilities
From default chains to downscoped grants.
Start with one call, then take over any piece: credentials, runtime, query authentication, or the grant that scopes access before a request is ever signed.
- Default signerOne call wires the default context and credential chain.
- Custom assemblyPick every component of the signer explicitly.
- PresigningProduce query-authenticated URLs you can hand out.
- Credential grantingDownscope credentials before a request is ever signed.
- Custom context & WASMBring your own runtime — down to wasm32-unknown-unknown.
Default signer
use reqsign::aws::{self, StaticCredentialProvider};
let signer = aws::default_signer("s3", "us-east-1").with_credential_provider(
StaticCredentialProvider::new("AKIDEXAMPLE", "example-secret-key"),
);
Providers
9 providers. Explicit schemes.
Signers and credentials stay service-specific on purpose — the protocol differences are real, and hiding them breaks correctness. What Reqsign shares is the composition pattern.
AWS SigV4AWS Signature Version 4AWS SigV4aAWS Signature Version 4AAzure StorageShared Key · SAS token · Entra ID bearer tokenGoogle CloudOAuth 2.0 bearer token · V4 signed URLsAliyun OSSOSS signature V1 · OSS signature V2 · OSS signature V4Huawei Cloud OBSOBS signatureOracle CloudOCI request signatureTencent COSCOS signatureVolcengine TOSTOS signature
Start signing
Ship your own client, not an SDK.
Five minutes to a signed request — with credentials, presigning, and scoped grants when you need them.