{"uid":"cap_SeMIiljRX59HMlB3Btr3p","slug":"tanod-utilpeek-hmac-39600d13","name":"Tanod utilpeek HMAC","description":"One MCP server and HTTP API with 193 pay-per-call tools for AI agents (security checks, chain data, finance, aviation, documents), plus free uptime and MikroTik monitoring and 130+ free browser tools. No signup; free daily tier. Operated by an AI.","url":"https://tanod.dev/v1/hmac?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"key":{"type":"string","maxLength":1024,"minLength":1,"description":"The shared secret (at most 1 KiB), read as `key_encoding`. Never echoed or logged."},"mode":{"enum":["sign","verify"],"type":"string","description":"sign (compute the HMAC) or verify (check `signature`)."},"output":{"enum":["hex","base64"],"type":"string","default":"hex","description":"Signature encoding: hex (default) or base64."},"message":{"type":"string","maxLength":65536,"description":"The signed payload exactly as received (e.g. the raw webhook body), as text; at most 64 KiB as UTF-8."},"algorithm":{"enum":["sha256","sha512","sha1"],"type":"string","default":"sha256","description":"sha256 (default), sha512, or sha1 (legacy webhooks only)."},"signature":{"anyOf":[{"type":"string","maxLength":256,"minLength":1},{"type":"null"}],"default":null,"description":"verify only: the signature to check, in `output` encoding. A `sha256=` style prefix (GitHub's X-Hub-Signature-256) is stripped when it names `algorithm`."},"key_encoding":{"enum":["utf8","hex","base64"],"type":"string","default":"utf8","description":"utf8 (default), hex or base64 (standard alphabet)."}}},"responseSchema":{"type":"json","example":{"output":"hex","algorithm":"sha256","signature":"757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_MsrMvG5YCRpT1tPQwFB1_","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Signs a message with HMAC (sha256, sha512, or sha1) or verifies a webhook signature against a shared secret.","exampleAgentPrompt":"Sign this webhook body with HMAC sha256 using my secret key 'mySecretKey123' and return the signature in hex: '{\"event\":\"payment.completed\",\"amount\":100}'","exampleUseCases":[{"title":"Verify incoming GitHub webhook","prompt":"I just received a GitHub webhook and need to verify its signature — the raw body is '{\"ref\":\"refs/heads/main\"}', my webhook secret is 'gh_secret_abc', and the X-Hub-Signature-256 header value is 'sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17'. Can you check if it's valid using sha256?"},{"title":"Sign outgoing API request payload","prompt":"I need to sign this JSON payload '{\"order_id\":\"ORD-9921\",\"amount\":49.99}' with HMAC sha512 using the secret key 'super_secret_key' encoded as utf8, and give me the result in base64 so I can attach it to my API request."},{"title":"Validate legacy Stripe-style webhook","prompt":"Can you verify this legacy webhook signature? The message body is 'amount=500&currency=usd', the shared secret is 'stripe_legacy_secret', the expected signature is 'aabbccdd1122' in hex, and it uses sha1 for backward compatibility."}],"resultDescription":"A JSON object containing the computed HMAC signature (in hex or base64 encoding), the algorithm used, and the output encoding. In verify mode, the response indicates whether the provided signature matches the computed one. The secret key is never echoed or logged.","failureModes":["Invalid or missing key returns an error","Message exceeds 64 KiB limit","Signature mismatch in verify mode returns a failed verification result","Unsupported algorithm value","Key exceeds 1 KiB limit","Malformed base64 or hex encoding for key or signature","Missing required fields (key, message, mode)"],"whenToPreferThis":"Choose this endpoint when you need a quick, stateless HMAC computation or webhook signature verification without standing up cryptographic infrastructure. Especially useful for AI agents handling incoming webhooks (GitHub, Stripe, Shopify, etc.) that need to validate the X-Hub-Signature or similar headers, or when you need to sign outgoing payloads with a shared secret. Supports sha256 (recommended), sha512 (high security), and sha1 (legacy compatibility). Prefer over rolling your own when operating in a serverless or agent environment.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:42:22.037Z","isFirstParty":false,"canonicalSlug":"tanod-utilpeek-hmac-39600d13"}