Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
sign
✓ import { sign } from 'http-message-sig'
✗ import sign from 'http-message-sig'
ESM only; named export. No default export.
verify
✓ import { verify } from 'http-message-sig'
✗ const { verify } = require('http-message-sig')
ESM-only package; CommonJS require() will not work.
SignOptions
✓ import type { SignOptions } from 'http-message-sig'
✗ import { SignOptions } from 'http-message-sig'
TypeScript users: import types with `import type` to avoid runtime overhead.
Demonstrates signing and verifying an HTTP message with HMAC-SHA256 using async operations.
import { sign, verify } from 'http-message-sig';
const key = await crypto.subtle.generateKey(
{ name: 'HMAC', hash: 'SHA-256' },
true,
['sign', 'verify']
);
const message = {
method: 'POST',
url: '/api/data',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ foo: 'bar' })
};
const signature = await sign(message, {
key: key,
keyId: 'my-key',
algorithm: 'hmac-sha256',
created: Math.floor(Date.now() / 1000),
expires: Math.floor(Date.now() / 1000) + 3600
});
console.log(signature);
const isValid = await verify(message, signature, {
key: key,
algorithm: 'hmac-sha256'
});
console.log('Signature valid:', isValid);
Errors
Common errors & fixes
Cannot find module 'http-message-sig' or its corresponding type declarations.
TypeScript may not resolve types for ESM packages if moduleResolution is not set to 'node16' or 'bundler'.
fixSet 'moduleResolution' to 'node16' or 'bundler' in tsconfig.json.
ERR_REQUIRE_ESM: require() of ES Module http-message-sig from not supported.
Trying to use require() on an ESM-only package.
fixUse import() syntax or switch to ES modules.
TypeError: crypto.subtle.generateKey is not a function
crypto.subtle is only available in secure contexts (HTTPS/localhost) and Node.js 15+.
fixRun in a secure context or use Node.js 15+. For Node.js 14 and below, use a polyfill.
Audit
Dependencies
No dependency data recorded yet.