Articles in this section

hmac helper

Tom Santiago
Updated

The hmac helper generates an HMAC (Hash-based Message Authentication Code) from a field or string value using a secret key and a supported hash algorithm. Use it to sign outbound requests or verify data integrity and authenticity.

Syntax

{{hmac "algorithm" key "encoding" field keyEncoding}}

algorithm -- The hashing algorithm to use. Required. Examples: "sha256", "sha1", "md5". Use "sha256" or stronger for security-sensitive use cases.

key -- The path to your secret key. Required. Always store the key in an encrypted connection field (e.g. connection.http.encrypted.secretKey) to prevent exposure.

encoding -- The output format of the HMAC. Required. Common values: "hex", "base64".

field -- The string or field value to authenticate. Required. Accepts a field reference or a literal string.

keyEncoding -- The encoding of the secret key. Optional. Defaults to "utf8". Accepted values: "utf8", "base64".

Examples

Generate a hex-encoded SHA-256 HMAC

{{hmac "sha256" connection.http.encrypted.secretKey "hex" record.payload}}

Uses the secret key from connection.http.encrypted.secretKey to produce a hex-encoded SHA-256 HMAC of record.payload.

Generate a base64-encoded HMAC with a base64-encoded key

{{hmac "sha1" connection.http.encrypted.secretKey "base64" record.body "base64"}}

Treats the secret key as base64-encoded and returns a base64-encoded SHA-1 HMAC of record.body.

Usage notes

  • Always store the secret key in an encrypted connection field (e.g. connection.http.encrypted). Never pass the key as a hard-coded literal.
  • HMAC is most effective when transmitted over HTTPS. Sending signatures over unencrypted connections reduces their security value.
  • The field parameter accepts a string or field reference. Passing the result of hmac into further dot-notation expressions is not supported.
  • For additional signing options -- such as signing a full URL including query parameters -- see Using hmacOptions.
  • To generate a one-way hash without a secret key, use the hash helper instead.