cURL to AWS SigV4 (Signature Version 4) Request Converter

What does the cURL to AWS SigV4 (Signature Version 4) Request Converter do?

The cURL to AWS SigV4 Request Converter parses standard HTTP curl commands and computes AWS Signature Version 4 (SigV4) components. It generates the normalized canonical request representation, string-to-sign hash, 4-tier HMAC-SHA256 signature key, Authorization header, and ready-to-execute signed cURL commands.

Core Concepts

Understanding AWS Signature Version 4 cryptographic signing:

• Canonical Request Construction: Standardizes HTTP method, URI paths, sorted query parameters, sorted lowercase headers, and the SHA256 hex hash of the request payload.
• String to Sign: Combines the algorithm (AWS4-HMAC-SHA256), request timestamp ISO string (e.g. 20260816T043000Z), credential scope (date/region/service/aws4_request), and the SHA256 hash of the canonical request.
• Derived Signing Key: Computes a 4-tier HMAC key sequentially derived from AWS4 + SecretAccessKey, date stamp, AWS Region, and AWS service identifier.
• Signed Request Generation: Produces executable cURL commands containing Authorization, x-amz-date, x-amz-content-sha256, and optional x-amz-security-token headers.

How to use the tool?

1. Enter AWS Credentials: Provide your AWS Access Key ID, Secret Access Key, target AWS Region (e.g. us-east-1), and AWS Service Name (e.g. dynamodb, execute-api, s3).
2. Paste cURL Command: Enter any raw HTTP cURL command or click Load Sample.
3. Convert & Copy: Click Convert to AWS SigV4 Request, then click Copy to copy the Authorization header or signed cURL command.

Related Developer Utilities

If you work with AWS APIs, authentication, and HTTP request signing, explore these complementary tools:

• AWS IAM Policy Visualizer: Parse and graph IAM JSON permissions.
• AWS IAM Policy Minifier: Compress IAM policies to resolve 6,144 character quota limits.
• AWS IAM OIDC Thumbprint Calculator: Calculate 40-character SHA-1 CA thumbprints for GitHub Actions.
• JWT Token Decoder: Decode and inspect JSON Web Tokens and OAuth claims.

REST API Integration

Blueutils provides a free REST API endpoint (POST https://blueutils.com/api/aws/curl-to-aws-sigv4) to programmatically parse raw cURL commands and generate AWS Signature Version 4 (SigV4) authorization headers, canonical requests, and HMAC-SHA256 signatures.

API Request Parameters

API Request Payload Examples

cURL

curl -X POST https://blueutils.com/api/aws/curl-to-aws-sigv4 \
  -H "Content-Type: application/json" \
  -d '{
    "curlCommand": "curl -X POST https://dynamodb.us-east-1.amazonaws.com -H \"X-Amz-Target: DynamoDB_20120810.ListTables\" -H \"Content-Type: application/x-amz-json-1.0\" -d \"{}\"",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "region": "us-east-1",
    "service": "dynamodb"
  }'

Python

import requests

url = "https://blueutils.com/api/aws/curl-to-aws-sigv4"
payload = {
    "curlCommand": 'curl -X POST https://dynamodb.us-east-1.amazonaws.com -H "Content-Type: application/x-amz-json-1.0" -d "{}"',
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "region": "us-east-1",
    "service": "dynamodb"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.json())

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String jsonPayload = """
            {
                "curlCommand": "curl -X POST https://dynamodb.us-east-1.amazonaws.com -H \\"Content-Type: application/x-amz-json-1.0\\" -d \\"{}\\"",
                "region": "us-east-1",
                "service": "dynamodb"
            }
            """;

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://blueutils.com/api/aws/curl-to-aws-sigv4"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
            .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

API Response Parameters

API Response Payload Examples

Success Response (HTTP 200 OK)

{
  "isValid": true,
  "authorizationHeader": "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20260816/us-east-1/dynamodb/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=5a1f...",
  "signedCurl": "curl -X POST \"https://dynamodb.us-east-1.amazonaws.com/\" \\\n  -H \"Authorization: AWS4-HMAC-SHA256 ...\"",
  "canonicalRequest": "POST\n/\n\ncontent-type:application/x-amz-json-1.0\nhost:dynamodb.us-east-1.amazonaws.com...",
  "stringToSign": "AWS4-HMAC-SHA256\n20260816T120000Z\n20260816/us-east-1/dynamodb/aws4_request...",
  "signature": "5a1f..."
}

Validation Failure Response (HTTP 400 Bad Request)

{
  "isValid": false,
  "error": "Conversion Error: Input must begin with \"curl\"."
}

Rate Limit Exceeded Response (HTTP 429 Too Many Requests)

{
  "error": "API rate limit exceeded. Please wait or contact support@blueutils.com."
}

Why use an API to sign cURL requests with AWS SigV4?

Integrating the cURL to AWS SigV4 Converter API into test suites, webhooks, or AI agent tool calling provides key benefits:

• Rapid Script Validation: Generates valid AWS-signed headers for raw HTTP requests before executing API Gateway calls.
• Optimized Token Efficiency for AI Agents: LLMs frequently fail to calculate multi-step SHA256 hashes and HMAC keys. Calling the API signs requests deterministically without token consumption.
• Deterministic Accuracy Without Hallucinations: Ensures 100% adherence to official AWS Signature Version 4 canonicalization standards.

Native Usage

How to sign AWS requests locally in terminal environments or scripts:

Windows / Linux / macOS (Python requests-aws4auth)

import requests
from requests_aws4auth import AWS4Auth

auth = AWS4Auth('AKIAIOSFODNN7EXAMPLE', 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', 'us-east-1', 'dynamodb')
response = requests.post(
    'https://dynamodb.us-east-1.amazonaws.com',
    auth=auth,
    headers={'X-Amz-Target': 'DynamoDB_20120810.ListTables', 'Content-Type': 'application/x-amz-json-1.0'},
    data='{}'
)
print(response.json())

Node.js (@aws-sdk/signature-v4)

import { SignatureV4 } from "@aws-sdk/signature-v4";
import { Sha256 } from "@aws-crypto/sha256-js";
import { HttpRequest } from "@aws-sdk/protocol-http";

const signer = new SignatureV4({
  credentials: { accessKeyId: "AKIA...", secretAccessKey: "secret..." },
  region: "us-east-1",
  service: "execute-api",
  sha256: Sha256
});

const request = new HttpRequest({
  method: "GET",
  protocol: "https:",
  hostname: "api.example.com",
  path: "/v1/items",
  headers: { host: "api.example.com" }
});

const signed = await signer.sign(request);
console.log(signed.headers);

Java (AWS SDK for Java v2)

import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
import software.amazon.awssdk.auth.signer.Aws4Signer;

public class SigV4SignerExample {
    public static void main(String[] args) {
        Aws4Signer signer = Aws4Signer.create();
        System.out.println("SigV4 Signer initialized: " + signer);
    }
}