HMAC Request Signature Generator

HMAC answers a question a plain hash cannot: was this message produced by someone who holds the secret, and has it been modified since? Because the key is mixed into the computation twice, an attacker who can see the message and the signature still cannot produce a signature for a different message.

Sign the exact bytes

This is where implementations break, and it breaks silently. A framework that parses JSON before your handler runs gives you an object. JSON.stringify of that object is not byte-identical to what was sent — key order may differ, whitespace is gone, Unicode may be escaped differently. The signature will not match, and the error will look like a wrong secret.

Capture the raw body:

// Express: keep the raw bytes alongside the parsed body
app.use(express.json({
  verify: (req, _res, buf) => { req.rawBody = buf; },
}));

// Next.js route handler: read the text before parsing
const raw = await request.text();
const parsed = JSON.parse(raw); // parse after signing check

Compare in constant time

A naive comparison returns as soon as two bytes differ. That timing difference is measurable over enough requests, and it lets an attacker recover the correct signature one byte at a time.

import { timingSafeEqual } from "node:crypto";

const a = Buffer.from(expected, "hex");
const b = Buffer.from(received, "hex");
const valid = a.length === b.length && timingSafeEqual(a, b);

The comparison on this page is constant-time for the same reason.

Encoding and prefixes

The signature is bytes; how you transmit it is a convention:

• Hex — lowercase, twice as long, unambiguous. Most common.
• Base64 — shorter. Shopify uses it.
• Prefixed — GitHub sends sha256= before the hex, which future-proofs the header against an algorithm change.

Any of these is fine; both sides must agree exactly.

Key length

The key should be at least as long as the hash output — 32 bytes for SHA-256. HMAC hashes keys longer than the block size before use, so a 1024-bit key gains nothing. Keys shorter than 128 bits are searchable offline by an attacker holding one signed message.

HMAC is not a signature in the public-key sense

It is symmetric. Both parties hold the same secret, so either could have produced any given signature. That is fine for verifying a webhook came from a provider you share a secret with. It cannot provide non-repudiation — for that you need an asymmetric signature from the RSA key pair generator.