How I create and check HMAC signatures for API requests

HMAC proves that a message was created by someone who knows the shared secret, and that the signed message has not changed.

The HMAC Generator tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.

The simple mental model

HMAC proves that a message was created by someone who knows the shared secret, and that the signed message has not changed.

I try to reduce the tool to one question: what input do I have, what output do I expect, and what would make the result unsafe or misleading?

Step 1: Write down the exact message string to sign

Write down the exact message string to sign.

Start with a small example first. A small example is easier to inspect than a real production-sized case.

Step 2: Choose the digest algorithm expected by the API

Choose the digest algorithm expected by the API.

Step 3: Enter the shared secret

Enter the shared secret.

Step 4: Generate the HMAC

Generate the HMAC.

Step 5: Compare it with the expected signature

Compare it with the expected signature.

Step 6: If it fails, compare the exact bytes of the message first

If it fails, compare the exact bytes of the message first.

Step 7: Keep the shared secret on the server side

Keep the shared secret on the server side.

My checklist

Before I trust the result, I check:

• Write down the exact message string to sign.
• Choose the digest algorithm expected by the API.
• Enter the shared secret.
• Generate the HMAC.
• Compare it with the expected signature.
• If it fails, compare the exact bytes of the message first.
• Keep the shared secret on the server side.

The tool saves time, but the important part is still understanding the input and reviewing the output before using it somewhere important.