# @digitalbazaar/http-signature-zcap-verify

> A library for invoking Authorization Capabilities via HTTP signatures

Latest version **11.2.1** (published 2026-09-16) · BSD-3-Clause license · 0 weekly downloads

## Install

```sh
npm install @digitalbazaar/http-signature-zcap-verify
pnpm add @digitalbazaar/http-signature-zcap-verify
yarn add @digitalbazaar/http-signature-zcap-verify
bun add @digitalbazaar/http-signature-zcap-verify
```

## Health

**Score 55/100 (C)** — status: active.

Positive: esm support; no vulnerabilities; recently updated.

Warnings: low downloads; no types.

## Facts

| | |
|---|---|
| Version | 11.2.1 |
| Published | 2026-09-16 |
| First published | 2022-01-11 |
| Weekly downloads | 0 |
| License | BSD-3-Clause |
| TypeScript types | none |
| Module format | ESM |
| Node | >=20 |
| Dependencies | 3 |
| Unpacked size | 15 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 3 |
| Author | Digital Bazaar, Inc. |
| Maintainers | dlongley, msporny, davidlehn, gannan |
| Keywords | authorization, capability, authorization capability, object capability, ocap-ld, http signature, http signatures, zcap, zcaps |

## Links

- npm: https://www.npmjs.com/package/@digitalbazaar/http-signature-zcap-verify
- Repository: https://github.com/digitalbazaar/http-signature-zcap-verify
- Issues: https://github.com/digitalbazaar/http-signature-zcap-verify/issues
- npm.io page: https://npm.io/package/@digitalbazaar/http-signature-zcap-verify

## Dependencies (3)

- [pako](https://npm.io/package/pako.md) ^2.1.0
- [@digitalbazaar/zcap](https://npm.io/package/@digitalbazaar/zcap.md) ^9.0.1
- [@digitalbazaar/http-signature-header](https://npm.io/package/@digitalbazaar/http-signature-header.md) ^5.0.1

## Alternatives

- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads
- [escher-request](https://npm.io/package/escher-request.md) — 545 weekly downloads

## Recent versions

- 11.2.1 (latest) — 2026-09-16
- 11.2.0 — 2025-10-08
- 11.1.1 — 2024-04-02
- 11.1.0 — 2022-11-13
- 11.0.0 — 2022-06-08
- 10.2.0 — 2022-05-13
- 10.1.0 — 2022-01-14
- 10.0.0 — 2022-01-11

## README

# http-signature-zcap-verify _(@digitalbazaar/http-signature-zcap-verify)_

A library for verifying Authorization Capability (ZCAP) invocations via HTTP
signatures

## Install

- Browsers and Node.js 22+ are supported.
- [Web Crypto API][] required. Older browsers and Node.js 14 must use a
  polyfill.

To install from NPM:

```
npm install @digitalbazaar/http-signature-zcap-verify
```

## Example "getVerifier" for "verifyCapabilityInvocation"

```js
import * as Ed25519Multikey from '@digitalbazaar/ed25519-multikey';

async function getVerifier({keyId, documentLoader}) {
  const {document} = await documentLoader(keyId);
  const key = await Ed25519Multikey.from(document);
  if(key.revoked) {
    throw new Error('Verification method has been revoked.');
  }
  const verificationMethod = await key.export(
    {publicKey: true, includeContext: true});
  const verifier = key.verifier();
  return {verifier, verificationMethod};
}
```

[Web Crypto API]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API

---
_Source: https://npm.io/package/@digitalbazaar/http-signature-zcap-verify · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._