Skip to content
uencoder
PIPELINE Security & Privacy Intermediate 1 step

HMAC-sign an API request string

When signing API requests, you concatenate the HTTP method, path, and timestamp into a canonical string, then sign it with your secret key using HMAC-SHA256. The resulting hex digest is sent in the X-Signature header.

What it solves

Generate an HMAC-SHA256 signature for a request payload to authenticate API calls.

Input → Output

HMAC Generator input → HMAC Generator output across 1 step.

Runs in

2–3 minutes · fully local in your browser.

Before you start

  • A canonical request string (method + path + timestamp)
  • A secret key known to both client and server

The pipeline

  1. 1 HMAC Generator hmac-generator

    Generate HMAC (Keyed-Hash Message Authentication Code) with SHA-1/256/512. Free, private, and 100% client-side.

    Params: algorithm=SHA-256, key=my-secret-key, outputFormat=hex

Open in Toolchain

Runs locally in your browser. The recipe defines the pipeline only — your input never leaves this tab.

▶Run this workflow

Enter your input below and click Run. All processing happens locally in your browser — nothing is uploaded.

Pipeline progress

  1. HMAC Generatorhmac-generator

Sample input

GET
/api/data
1700000000

Expected output

79517301cb2bbff5118ba603407d58d99d6fa4c6b7a2e9407b62a7cb26909aca

This pair is executed against the real tools at build time (tests/unit/recipes.test.ts) — the expected output is verified, not illustrative.

Related workflows

Hash text and verify with CRC32 checksum
Compute both a cryptographic SHA-256 hash and a CRC32 checksum for data integrity verification.
PIPELINE
Decode and format a JWT payload
Parse a JWT token, extract its payload, and format the JSON for inspection.
PIPELINE

You might also need

Workflows sharing tools or topics with this recipe.

HMAC sign and verify
Generate an HMAC signature for a message and verify it against an expected signature.
PIPELINE
Decode JWT and inspect payload
Decode a JWT token to its header and payload, then pretty-print the JSON for inspection.
PIPELINE

Learn more

Choosing a hash algorithm: digests, password hashing, and MACs are three different jobs
A field guide to SHA-2, SHA-3, BLAKE2, MD5, bcrypt/Argon2, and HMAC — which one fits integrity checks, password storage, and message authentication, and why they are not interchangeable.
TUTORIAL
How to Chain Encoding and Hashing Workflows
Real data-processing tasks rarely use a single tool. This tutorial shows how to compose encoding and hashing tools into multi-step pipelines: a base64-to-hash-to-hex verification chain, parallel multi-algorithm integrity checking, and an automatic encoding-format conversion chain. Each pattern maps to an existing workflow recipe (base64-encode-decode-verify, hmac-sign-verify) and explains when to use inline tool chaining versus a saved recipe.
TUTORIAL

Tools used

HMAC Generator
Generate HMAC (Keyed-Hash Message Authentication Code) with SHA-1/256/512. Free, private, and 100% client-side.
TOOL
Hash Calculator
Compute MD5, SHA-1, SHA-256, or SHA-512 hashes with hex or Base64 output. Free, private, and 100% client-side.
TOOL