# How I create and check HMAC signatures for API requests

A beginner-friendly guide to HMAC signatures, shared secrets, message strings, digest algorithms, and common verification mistakes.

- Date: 2026-09-27
- URL: https://ilham.dev/posts/how-to-create-and-check-hmac-signatures/
- Markdown: https://ilham.dev/posts/how-to-create-and-check-hmac-signatures/index.md
- Tags: hmac, api, security, tools
- Reading time: 2 min


HMAC proves that a message was created by someone who knows the shared secret, and that the signed message has not changed.

The [HMAC Generator](/tools/hmac-generator/) tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.

## The simple mental model

HMAC proves that a message was created by someone who knows the shared secret, and that the signed message has not changed.

I try to reduce the tool to one question: what input do I have, what output do I expect, and what would make the result unsafe or misleading?

## Step 1: Write down the exact message string to sign

Write down the exact message string to sign.

Start with a small example first. A small example is easier to inspect than a real production-sized case.

## Step 2: Choose the digest algorithm expected by the API

Choose the digest algorithm expected by the API.

## Step 3: Enter the shared secret

Enter the shared secret.

## Step 4: Generate the HMAC

Generate the HMAC.

## Step 5: Compare it with the expected signature

Compare it with the expected signature.

## Step 6: If it fails, compare the exact bytes of the message first

If it fails, compare the exact bytes of the message first.

## Step 7: Keep the shared secret on the server side

Keep the shared secret on the server side.

## My checklist

Before I trust the result, I check:

- Write down the exact message string to sign.
- Choose the digest algorithm expected by the API.
- Enter the shared secret.
- Generate the HMAC.
- Compare it with the expected signature.
- If it fails, compare the exact bytes of the message first.
- Keep the shared secret on the server side.

The tool saves time, but the important part is still understanding the input and reviewing the output before using it somewhere important.