hawk

hawk is a JavaScript library implementing the Hawk HTTP authentication scheme, a holder-of-key (HMAC-based) protocol for verifying the authenticity of HTTP requests using a shared symmetric key. Rather than sending credentials in the clear, each request carries a signed MAC over its method, URI, host, and optionally its payload, so a server can confirm the request came from a legitimate client and was not tampered with in transit.

The package provides both the client side, which builds Authorization headers, and the server side, which authenticates incoming requests, along with helpers for bewit (single-URI) authentication and response validation. Note that the upstream project has been archived by Mozilla as complete.

What You Get

• Client helpers to generate Hawk Authorization headers for requests
• Server helpers to authenticate incoming Hawk-signed requests
• Bewit support for signing single URIs (e.g. for links or downloads)
• Payload and response validation using HMAC over request/response content

Common Use Cases

• Authenticating API requests between trusted services with a shared key
• Signing time-limited download or resource URLs via bewit tokens
• Verifying request integrity to prevent tampering in transit

Under The Hood

Architecture - The lib splits cleanly into client.js (header/bewit generation), server.js (request authentication and response validation), crypto.js (MAC and hash computation), and utils.js (nonce, timestamp, and parsing helpers), all re-exported from index.js. The core flow computes an HMAC over a normalized request artifact string using a shared key and algorithm, which both sides derive identically.

Tech Stack - Plain JavaScript (Node) with no framework dependency, relying on standard crypto primitives for HMAC-SHA signatures. The implementation follows the finalized Hawk protocol specification.

Code Quality - A long-lived, widely deployed library with an extensive test/ directory and mature API documentation (API.md). It has been battle-tested across the ecosystem, though the repository is now archived and unmaintained by Mozilla, with the protocol considered complete.

API Design - The public surface mirrors the protocol’s two roles: hawk.client.header(…) to sign and hawk.server.authenticate(…) to verify, plus bewit helpers. Naming maps directly onto Hawk concepts, so developers familiar with the scheme find the API predictable.