AWS SigV4 Canonical Request Preview

AWS Signature Version 4 does not sign the request directly: it first assembles a canonical form, a text holding the method, path, parameters, headers and body digest in a fixed order and format. That text is what goes into the calculation. When a signature does not match, the problem is almost always in building that canonical form rather than in the cryptography.

Fill in the fields and the page shows the resulting canonical text. It is for comparing against what your library produces — AWS reports the canonical form it computed inside the invalid-signature error message, and comparing the two line by line locates the divergence in seconds.

Worth being clear about scope: this is a preview of the structure, with fixed signed headers and the body declared as unsigned. The complete canonical form requires normalising the path, encoding each parameter under its own rules, sorting parameters by name and headers by lowercase name, and collapsing whitespace in values. Those normalisation steps are precisely where hand-rolled implementations go wrong.