I wrote sigflint because I wanted to sign AWS requests from Node, Bun, Deno, Cloudflare Workers and browsers without pulling in an SDK. It is a single package with no dependencies that signs requests as an Authorization header or a presigned URL, for S3 and any other AWS service. It also does SigV4a (multi-region), chunked uploads and event streams.

What I checked, and how:

- Signatures match botocore for all 3,360 S3 requests in the test corpus, plus 1,622 requests to other services and 1,600 presigned URLs. SigV4a signatures verify against the AWS CRT's, and chunk and event signatures match the AWS SDK's. For S3, botocore signs after this repository's own path and query normalization, so that step is checked only by the four S3 examples AWS publishes. - Speed: 1.0 to 3.2 µs per header or presigned-URL signature on Node 26.12.1 and 0.7 to 3.0 µs on Bun 1.4.4; an S3 GET signs in 0.97 µs on Node. The six other libraries I compared took 2.0 to 75 times as long on the requests they sign correctly. Synthetic requests with warmed signing-key caches; no network request is measured. - Size: the bundled, minified header signer is 5.7 kB, 2.8 kB gzipped, and the other signers add to a bundle only when imported.

Feedback on the API or on requests it signs wrongly is welcome: https://github.com/bompus/sigflint/issues