Please provide pros of signing http api requests. For instance, Amazon requires requests to their web APIs be signed.

If traffic is not encrypted, then a signature can prove your identity as a secret key holder and prevent tampering with request. But what about https? Why use request payload in this case?

closed as unclear what you're asking by Tobi Nary, Xiong Chiamiov, Steve, ISMSDEV, Mike Ounsworth Nov 30 '17 at 19:03

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Sorry, but I've read your question over 3 times and still can't figure out what you are asking. What, exactly, do you mean by "require their APIs consumers to sign requests" ? Without more context, I don't think anyone can answer this. It depends what the API is for, and the details of what's being signed by what key. Basically: please provide more details. – Mike Ounsworth Nov 30 '17 at 19:03

You've kind of answered it in your question: HTTPS provides encryption, which prevents tampering with the request in a lot of cases, but doesn't prove anything about the identity of the person making the request in the first place (unless client certificate authentication is used, which isn't particularly common).

By getting the user to sign requests, they can be more confident that the user is who they claim to be (or, at least, someone who has stolen their secret key data).

Not the answer you're looking for? Browse other questions tagged or ask your own question.