# @tryghost/signed-request

Latest version **2.0.4** (published 2026-11-12) · MIT license · 0 weekly downloads

## Install

```sh
npm install @tryghost/signed-request
pnpm add @tryghost/signed-request
yarn add @tryghost/signed-request
bun add @tryghost/signed-request
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 2.0.4 |
| Published | 2026-11-12 |
| First published | 2019-10-11 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=22.12.0 |
| Dependencies | 1 |
| Unpacked size | 13 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Ghost Foundation |
| Maintainers | zimoatghost, allouis, kernalghost, chrisraible, erisds, johnonolan, kevinansfield, cobbspur, aileencgn, jloh, minimaluminium, sam-lord, pauladamdavis, bobvaneck, joeegrigg, hadret, erik-ghost, sagzy, vershwal, zach1618, mike182uk, luissazevedo, lsinger, nickmoreton, renatoworks, rblstr-ghost, evanhahn-ghost, austin.burdine, fosxsters, foxsters, afeinsod, weylandswart, louisghost, ghost-slimer, tmciesco, jonatan-ghost, 9larsons |

## Links

- npm: https://www.npmjs.com/package/@tryghost/signed-request
- Repository: https://github.com/TryGhost/Pro-Packages
- npm.io page: https://npm.io/package/@tryghost/signed-request

## Dependencies (1)

- [ky](https://npm.io/package/ky.md) ^2.2.0

## Recent versions

- 2.0.4 (latest) — 2026-11-12
- 2.0.3 — 2026-11-11
- 2.0.2 — 2026-11-11
- 2.0.1 — 2026-11-09
- 2.0.0 — 2026-11-03
- 1.0.5 — 2026-09-15
- 1.0.4 — 2026-08-19
- 1.0.3 — 2026-07-16
- 1.0.2 — 2026-07-16
- 1.0.1 — 2026-07-06
- 1.0.0 — 2026-06-25
- 0.3.8 — 2026-06-25
- 0.3.7 — 2026-06-25
- 0.3.6 — 2026-06-24
- 0.3.5 — 2026-06-24
- … 13 more at https://npm.io/package/@tryghost/signed-request/versions

## README

# Signed Request

Make a signed GET request to another Ghost(Pro) service. The package appends a
timestamp and optional source to the request path, signs it with an HMAC-SHA1
digest, and sends it with [`ky`](https://github.com/sindresorhus/ky) (native
`fetch`).

## Install

`npm install @tryghost/signed-request --save`

or

`pnpm add @tryghost/signed-request`

## Usage

Provides a signed GET request

Needs the following minimum arguments:
Arg 1: hmac_key used to sign the request
Arg 2: server address or ip to send request to (protocol is stripped)
Arg 3: additional path of request or empty string e.g: /packages
Optional Arg 4: options object with properties:

- source - where your request originated from
- protocol - to overwrite default request protocol of http://
- timeout - timeout in milliseconds for each attempt (default 5000)
- retries - number of retries for retryable failures (default 3)
- dispatcher - undici dispatcher passed through to `fetch`, e.g. an undici
  `Agent` for keep-alive

The package ships TypeScript types and both CommonJS and ESM builds. `exec` is
accessed as a property of the imported module — `signedRequest.exec(...)` — and
returns ky's `ResponsePromise`. Prefer its body shortcuts —
`await signedRequest.exec(...).json()` or `.text()` — which keep `timeout`
applied while the body downloads. Awaiting `exec()` gives the native `fetch`
`Response`, but reading its body with `response.json()` is not bounded by
`timeout`. Non-2xx responses reject with `HTTPError` (with `error.response`),
network failures with `NetworkError`, and timeouts with `TimeoutError`; all are
re-exported from this package. Requests that time out are retried.

#### CommonJS

```js
const signedRequest = require('@tryghost/signed-request');

async function purge() {
    const body = await signedRequest.exec(hmac, server, path, options).json();
}
```

#### ESM / TypeScript

```js
import signedRequest from '@tryghost/signed-request';

const body = await signedRequest.exec(hmac, server, path, options).json();
```

The ESM example uses a default import (requires `esModuleInterop` /
`allowSyntheticDefaultImports` in TypeScript); the imported value is the module
namespace, so call `signedRequest.exec(...)` exactly as in CommonJS.

## Develop

This is a monorepo package, managed from the repo root.

Follow the instructions for the top-level repo.

1. `git clone` this repo & `cd` into it as usual
2. Run `pnpm install` to install top-level dependencies.

## Run

- `pnpm --filter @tryghost/signed-request dev`

## Test

- `pnpm --filter @tryghost/signed-request lint` runs lint
- `pnpm --filter @tryghost/signed-request test` runs lint and tests

# Copyright & License

Copyright (c) 2013-2026 Ghost Foundation - Released under the [MIT license](LICENSE).

---
_Source: https://npm.io/package/@tryghost/signed-request · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._