kinetis/aws-sigv4

A PSR-18 client decorator that signs outgoing requests with AWS Signature Version 4 (SigV4) — reused signing logic from async-aws/core, non-blocking via kinetis/revolt-http-client. Usable standalone, not only with Kinetis.

v1.1.3 2026-08-16 08:57 UTC

Requires

• php: ^8.4
• async-aws/core: ^1.20
• kinetis/revolt-http-client: ^1.0
• psr/http-client: ^1.0
• psr/http-message: ^2.0

Requires (Dev)

• infection/infection: ^0.34.2
• kinetis/framework: ^1.6
• nyholm/psr7: ^1.8
• phpstan/phpstan: ^2.2
• phpunit/phpunit: ^11.0
• vimeo/psalm: ^6.16

MIT

• Alon Noy

Published on Packagist.org on 2026-08-16 08:57 UTC

README

kinetis/aws-sigv4
A PSR-18 client decorator that signs requests with AWS Signature Version 4

Wraps any PSR-18 HTTP client and signs every outgoing request with AWS Signature Version 4 (SigV4) before delegating to it — the signing math itself is AsyncAws\Core\Signer\SignerV4, the same class every AsyncAws service client already uses internally, reused directly rather than reimplemented. Usable standalone with any PSR-18 client, not only kinetis/revolt-http-client — and usable outside Kinetis entirely, the same relationship kinetis/revolt-http-client already has with the wider PHP ecosystem.

use Kinetis\AwsSigV4\SigV4SigningClient;
use Kinetis\RevoltHttpClient\AmpHttpClientFactory;
use Symfony\Component\HttpClient\Psr18Client;

$signedClient = new SigV4SigningClient(
    client: new Psr18Client(AmpHttpClientFactory::create()),
    region: 'us-east-1',
    service: 'es', // Amazon OpenSearch Service's signing name
);

$response = $signedClient->sendRequest($request);

$service is the AWS signing service name ("es" for Amazon OpenSearch Service, "execute-api" for API Gateway, and so on) — required, with no default, since guessing wrong produces a signature that fails verification rather than an obvious error.

Credentials

Resolved through AsyncAws's own default provider chain (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, a shared credentials file, or an IAM role) unless a CredentialProvider is passed directly as the fourth constructor argument. The chain's own bootstrap HTTP calls (an instance-metadata or container-credentials lookup) go through AmpHttpClientFactory::create() too, so credential resolution never blocks the worker either.

Installation

composer require kinetis/aws-sigv4

Requires PHP 8.4+ and kinetis/revolt-http-client. Full documentation: docs.kinetis.dev/aws-sigv4.html.

License

MIT — see LICENSE.