 <p>Short answer: Your form, lets call it X, needs to post back to A. A can then sign the request and then forward all of this onto B. </p> <p>If you do NOT post back to A, then how does B know that the request came from A? A has no clue what the client, who we will call Zed, sends? A only sent form X to Zed and is no longer involved in the conversation otherwise. </p> <p>Zed, can post anything in X they want to back to A. Zed may be malicious, or Zed may be the victim of a CSRF. However, your question is only that B knows that the request is coming from A. A can validate the input and take appropriate action. If A chooses to accept input form X and sign the request and send to B, B will then know that the request came from A.</p> <p>This idea is similar to what <a href="http://oauth.net/core/1.0a/" rel="nofollow">OAuth 1.0a</a> does. </p> <p>Take all form variables in X and create a URL encoded string with the keys sorted by alpha-numeric sorting. </p> <pre><code>$str = "keyA=&lt;val1&gt;&amp;keyB=&lt;val2&gt;&amp;keyB123=&lt;val3&gt;"; </code></pre> <p>Then hash and sign this. <a href="http://php.net/manual/en/function.hash-hmac.php" rel="nofollow">HMAC-SHA1 is once such algorithm</a> to do this. For the key, you need to generate some random string of characters and numbers. Both A and B should know this value and you should keep it VERY PRIVATE. You can then generate the signature to add to your request to B. </p> <pre><code>$signature = hash_hmac("sha1", $str, $key); </code></pre> <p>B can verify the signature for form X by performing the same steps that you did to create the original <code>$str</code>.</p>