What is an HMAC signature?

HMAC signature, explained#

HMAC stands for hash-based message authentication code. It combines a cryptographic hash, such as SHA-256, with a secret key in a way that resists the attacks a naive hash(secret + message) would allow. Anyone can compute a plain hash of a message, but only someone with the key can produce the right HMAC.

Webhooks are the most common place you meet it. The sender and receiver share a signing secret, shown once when the webhook is set up. For each delivery, the sender computes the HMAC of the request body, often prefixed by a timestamp, and puts it in a header. The receiver reads the raw body exactly as received, computes the same HMAC with its copy of the secret, and accepts the request only if the two match.

Three details decide whether verification is actually safe. First, sign and verify the raw bytes, not JSON you have parsed and re-serialised, because whitespace or key order changes the result. Second, compare with a constant-time function such as timingSafeEqual or hmac.compare_digest, so an attacker cannot learn the signature one byte at a time from response timings. Third, include a timestamp in what is signed and reject old ones, so a captured request cannot be replayed later.

HMAC proves who sent a message and that it is intact. It does not hide the content, so the request should still travel over HTTPS. If the secret leaks, rotate it.

For example, a header reads t=1761552000,v1=5f2b…. The receiver builds the string 1761552000. followed by the raw body, computes HMAC-SHA256 with the secret, encodes it as hex, checks it equals the v1 value in constant time, and checks the timestamp is within five minutes of now.