I am reading this documentation from Mastodon . And from it, I understand that Mastodon requires an HTTP Signature, signing at least these headers: (request-target) host date digest If your client is written in JavaScript and runs on Nodejs, an example for how to build a signature is given on the npmjs site . But I believe this example is out of date. It does not use the (request-target) pseudo header. So that’s not gonna work. So what must you do? Go back to the Mastodon documentation. Unfortunately, that
Regardless of the digest algorithm you use, the computed digest is a byte array. That brings us to the next question: how to encode that byte array as a string, in order to pass it to Mastodon. Some typical options for encoding are: hex encoding (aka base16 encoding), base64 encoding, or base64-url encoding. The documentation does not state which of those encodings is accepted. Helpfully, the example provided in the documentation shows a digest string that appears to be hex-encoded. Unhelpfully, again accor
With these gaps and misleading things in the documentation, I think it would be impossible for a neophyte to navigate the documentation and successfully implement a client that passes a validatable signature.