diff --git a/t/.gitignore b/t/.gitignore
index 9895d25c6..82a4dbdc0 100644
--- a/t/.gitignore
+++ b/t/.gitignore
@@ -28,3 +28,4 @@ test-mix-buffer
 test-amr-decode
 test-amr-encode
 aead-decrypt
+s3-auth
diff --git a/t/Makefile b/t/Makefile
index 3462a2c73..575c7bf51 100644
--- a/t/Makefile
+++ b/t/Makefile
@@ -94,6 +94,9 @@ ifneq ($(have_liburing),yes)
 LIBSRCS+=	uring.c
 endif
 
+SRCS+=		s3-auth.c
+LIBSRCS+=	s3utils.c
+
 COMMONOBJS=	str.o auxlib.o rtplib.o loglib.o ssllib.o
 
 include ../lib/common.Makefile
@@ -114,8 +117,10 @@ ifeq ($(RTPENGINE_EXTENDED_TESTS),1)
 TESTS+=		test-amr-decode test-amr-encode
 endif
 endif
+TESTS+=		s3-auth
 
 ADD_CLEAN=	tests-preload.so time-fudge-preload.so $(TESTS) aead-decrypt
+ADD_CLEAN+=	s3-auth
 
 ifeq ($(with_transcoding),yes)
 all-tests:	unit-tests daemon-tests
@@ -333,6 +338,8 @@ test-kernel-module: test-kernel-module.o $(COMMONOBJS) kernel.o
 
 test-const_str_hash.strhash: test-const_str_hash.strhash.o $(COMMONOBJS) bencode.o
 
+s3-auth:	s3-auth.o s3utils.o
+
 PRELOAD_CFLAGS += -D_GNU_SOURCE -std=c11
 PRELOAD_LIBS += -ldl
 
diff --git a/t/s3-auth.c b/t/s3-auth.c
new file mode 100644
index 000000000..7b6621d52
--- /dev/null
+++ b/t/s3-auth.c
@@ -0,0 +1,41 @@
+#include <glib.h>
+#include <assert.h>
+#include <stdio.h>
+#include "s3utils.h"
+
+int main(void) {
+	// date from S3 example
+	struct tm now = {
+		.tm_year = 113, // 2013
+		.tm_mon = 4, // May
+		.tm_mday = 24,
+		.tm_hour = 0,
+		.tm_min = 0,
+		.tm_sec = 0,
+		.tm_gmtoff = 0,
+	};
+
+	// empty body
+	char digest[SHA256_DIGEST_LENGTH * 2 + 1];
+	sha256_digest_hex(digest, "", 0);
+
+	assert(strcmp(digest, "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855") == 0);
+
+	// S3 example auth
+	g_autoptr(GString) s = s3_make_auth("examplebucket.s3.amazonaws.com",
+			"/", "test.txt", "us-east-1", &now,
+			digest, "AKIAIOSFODNN7EXAMPLE",
+			"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY");
+
+	// S3 example result, minus the "range" header and with PUT
+	printf("calculated auth string:\n%s\n", s->str);
+
+	assert(strcmp(s->str, "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/"
+				"s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;"
+				"x-amz-date,Signature="
+				"ea04dce2c5225534613582aa88f3fa9164370b73f396ad0e8cfeda0e9ef6669e") == 0);
+
+	printf("auth matches\n");
+
+	return 0;
+}