---
signatures:
  reject_older_than:  6000 # seconds
  created_required:   true
  keyid_required:     true
  # nonce_required:   false
  # alg_required:     false
  # tag_required:     false
  # expires_required: false
  covered_components:
  - "@method"
  - "@request-target"
  - date
  # In most cases is not needed to configure a label but it
  # could useful in the event of receiving a signature
  # header with more than 1 signature. Currently, linzer signatures
  # middleware will only validate 1 signature per request and multiple
  # signatures validation at the same time are not supported.
  # If you need this, feel free to open an issue and explain your use case.
  # default_label:      "mylabel"
keys:
  foo:
    alg: ed25519
    material: |
      -----BEGIN PUBLIC KEY-----
      MCowBQYDK2VwAyEAMEH9bSanwgAWE5qxUEaXjK6qei8z2hiHT0nlr7ljG0Y=
      -----END PUBLIC KEY-----
  bar:
    alg: rsa-pss-sha512
    path: pubkey_rsa.pem
  baz:
    alg: hmac-sha256
    path: app.secret
