{"uid":"cap_C6X2beRjThFjlWmmadkjG","slug":"hmac-signature-computation-2b82d2db","name":"HMAC Signature Computation","description":"Compute a keyed HMAC of some data with a secret key — the standard way to sign and verify webhooks (Stripe, GitHub, etc.) and API requests. Data and key may each be utf8/hex/base64/base64url; the tag is returned as hex/base64/base64url.","url":"https://hash.openverbs.com/v1/hmac","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["data","key","algorithm"],"properties":{"key":{"type":"string","maxLength":16384,"minLength":1,"description":"The secret key, in `keyEncoding`."},"data":{"type":"string","maxLength":5000000,"description":"The data to authenticate, in `inputEncoding`."},"algorithm":{"enum":["sha256","sha512","sha384","sha224","sha1","sha3-256","sha3-384","sha3-512","md5","ripemd160","blake2b512","blake2s256"],"type":"string","description":"Digest algorithm, one of sha256, sha512, sha384, sha224, sha1, sha3-256, sha3-384, sha3-512, md5, ripemd160, blake2b512, blake2s256."},"keyEncoding":{"enum":["utf8","hex","base64","base64url"],"type":"string","description":"How to interpret the key as bytes (utf8, hex, base64, base64url). Default utf8."},"inputEncoding":{"enum":["utf8","hex","base64","base64url"],"type":"string","description":"How to interpret the text as bytes (utf8, hex, base64, base64url). Default utf8."},"outputEncoding":{"enum":["hex","base64","base64url"],"type":"string","description":"How to render the digest (hex, base64, base64url). Default hex."}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_DeIQTeF92qjQ8MKt2KreQ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Computes a keyed HMAC (Hash-based Message Authentication Code) over arbitrary data using a shared secret key, supporting SHA-2, SHA-3, BLAKE2, and legacy digest algorithms.","exampleAgentPrompt":"Compute an HMAC-SHA256 signature for this webhook payload — the data is 'user_id=42&event=payment.succeeded' (UTF-8), the secret key is 'mysecretkey' (UTF-8), and return the result as hex.","exampleUseCases":[{"title":"Verify incoming Stripe webhook","prompt":"Sign the raw Stripe webhook body 'amount=1000&currency=usd&event=charge.succeeded' with my secret 'whsec_abc123' using HMAC-SHA256 and return the hex digest so I can compare it to the Stripe-Signature header."},{"title":"Authenticate GitHub webhook delivery","prompt":"Compute a GitHub-style HMAC-SHA256 signature of my webhook payload 'ref=refs/heads/main&pusher=alice' using the secret 'github_secret_xyz' encoded as UTF-8 and give me the result in hex."},{"title":"Sign outbound API requests with HMAC-SHA512","prompt":"Generate an HMAC-SHA512 tag for my API request body 'action=transfer&amount=500' using the base64-encoded key 'c2VjcmV0a2V5MTIz' — decode the key from base64 — and return the signature as base64url."}],"resultDescription":"Returns the HMAC authentication tag as a string in the requested output encoding (hex by default, or base64/base64url). The tag can be directly compared to an expected signature to verify authenticity, or attached to an outbound request as a signature header.","failureModes":["Invalid or unsupported algorithm name returns a 400 error","Data or key exceeding size limits (5 MB data, 16 KB key) may be rejected","Mismatched encoding specification (e.g. non-hex string declared as hex) causes a decoding error","Missing required fields (data, key, algorithm) returns a validation error","Payment failure or insufficient USDC balance blocks the request with a 402 response"],"whenToPreferThis":"Choose this endpoint when you need a keyed HMAC rather than a plain cryptographic hash — specifically for webhook signature verification (Stripe, GitHub, Shopify, etc.), API request authentication, or any scenario requiring a shared-secret MAC. Prefer this over a plain hash endpoint whenever message authenticity (not just integrity) is required. Use the sibling plain-hash endpoint when no key/secret is involved.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:30:24.539Z","isFirstParty":false}