Appsync signature authentication failing with signature missmatch

I'm trying to do a request to appsync from a node server, using aws4 module. My keys and iam policy in the user seem correct, but I'm getting this error

{"errors":[{"errorType":"BadRequestException","message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.


The Canonical String for this request should have been
'POST
/graphql

content-type:application/json
host:*****.appsync-api.eu-central-1.amazonaws.com
x-amz-date:20230303T180202Z

content-type;host;x-amz-date
7f0fb133cf00e6ce0efa197c0e1737c04608f5bc1ee1316a56e0ab5929311496'


The String-to-Sign should have been
'AWS4-HMAC-SHA256
20230303T180202Z
20230303/eu-central-1/appsync/aws4_request
201966c7d6de1f6a0d30748e5e4db678a6dd8eae8011cc4d8a3c91a793f0bbb9'
"}]}

I have a user with a policy to access my graphql api, and his keys are stored in process.env AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

here is the code calling it

  const options = {
    hostname: hostname,
    path: path,
    service: service,
    method: 'POST',
    region: process.env.AWS_REGION,
    timeout: 5000,
    headers: { ...headers, 'Content-Type' : 'application/json' }
  };
  
  return new Promise((resolve, reject) => {
    const req = https.request(aws4.sign(options), (res) => {.....}
.....