Compute an HMAC signature
Exacthashing_hmacDeterministic and authoritative — the canonical answer for this input.
Compute an HMAC (keyed hash) of a message with a shared secret key. algorithm is any SHA-family hash (sha256 default, sha512, sha1, ...). Deterministic — useful for signing/verifying webhook payloads. Processing multiple inputs? Use `hashing_hmac_batch` to do up to 1000 in one call.
Parameters
valuestringrequiredThe message to sign.
keystringrequiredThe shared secret key.
algorithmstringoptionalHash family: sha256 (default), sha512, sha1, ...
Call it
curl -X POST https://api.snipget.ai/v1/hashing/hmac \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{"value":"{\"order_id\":\"A-1042\",\"total\":59.90}","key":"shhh-secret","algorithm":"sha256"}'The Batch tab sends up to 1000 inputs in one call via /v1/hashing/hmac/batch.
Example response
{
"input": "{\"order_id\":\"A-1042\",\"total\":59.90}",
"is_valid": true,
"algorithm": "sha256",
"digest": "10d02bd5b6b28be40ecd697f582277b439b38f24fb039e1ba26c58388dded6be",
"digest_length": 64
}FAQ
What is an HMAC and why would I want one?
An HMAC is a fingerprint of a message that also mixes in a shared secret key. It proves a message really came from someone who knows the secret and was not tampered with. It is what services like Stripe, GitHub, and Slack use to sign the webhooks they send you.
Is this the same as a plain checksum?
No. A plain checksum can be recreated by anyone, but an HMAC needs the secret key. Without the key you cannot produce or fake the signature, which is what makes it useful for verifying that a message is authentic.
Is the result always the same?
Yes. This is an exact, deterministic tool. The same message, key, and algorithm always produce the identical signature, which is how you verify an incoming webhook by recomputing it and comparing.
Which algorithms are supported?
The SHA family, sha256 (the default), sha512, sha1, and the SHA-2 and SHA-3 variants. The lightweight checksums adler32 and crc32 are not valid for HMAC and are rejected.
What happens if I forget the key or send a bad algorithm?
A missing/empty key or an unsupported algorithm is a request mistake: the call is rejected with an INVALID_INPUT error explaining what was wrong, and rejected calls are not billed.