Signed Request

Make a signed GET request to another Ghost(Pro) service. The package appends a timestamp and optional source to the request path, signs it with an HMAC-SHA1 digest, and sends it with got.

Install

npm install @tryghost/signed-request --save

or

pnpm add @tryghost/signed-request

Usage

Provides a signed GET request

Needs the following minimum arguments: Arg 1: hmac_key used to sign the request Arg 2: server address or ip to send request to (protocol is stripped) Arg 3: additional path of request or empty string e.g: /packages Optional Arg 4: options object with properties:

• source - where your request originated from
• protocol - to overwrite default request protocol of http://

The package ships TypeScript types and both CommonJS and ESM builds. exec is accessed as a property of the imported module — signedRequest.exec(...) — and returns a promise that resolves to the got response.

CommonJS

const signedRequest = require('@tryghost/signed-request');

async function purge() {
    const response = await signedRequest.exec(hmac, server, path, options);
}

ESM / TypeScript

import signedRequest from '@tryghost/signed-request';

const response = await signedRequest.exec(hmac, server, path, options);

The ESM example uses a default import (requires esModuleInterop / allowSyntheticDefaultImports in TypeScript); the imported value is the module namespace, so call signedRequest.exec(...) exactly as in CommonJS.

Develop

This is a monorepo package, managed from the repo root.

Follow the instructions for the top-level repo.

1. git clone this repo & cd into it as usual
2. Run pnpm install to install top-level dependencies.

Run

• pnpm --filter @tryghost/signed-request dev

Test

• pnpm --filter @tryghost/signed-request lint runs lint
• pnpm --filter @tryghost/signed-request test runs lint and tests

Copyright & License

Copyright (c) 2013-2026 Ghost Foundation - Released under the MIT license.