The signer lists covered components — derived ones such as @method, @authority, @path, @query, @status, and header fields such as content-digest — with parameters created, expires, nonce, keyid, alg and tag, in Signature-Input; the signature base is a canonical text built from those values, and Signature holds the result. Algorithms include ecdsa-p256-sha256 (raw r‖s), ed25519, rsa-pss-sha512 and hmac-sha256.
Covering the body requires a Content-Digest header (RFC 9530). Because intermediaries may rewrite headers, signers should cover only components that survive the path. Uses include Web Bot Auth for identifying automated clients, the FAPI 2.0 message-signing profile, Mastodon-style federation moving off the older draft-cavage signatures, and webhook signing.
The HTTP message signatures tool builds the signature base and verifies signatures locally.