Verify an HMAC-SHA256 request signature

POSThttps://api.testingapis.com/api/auth/hmacSign in to see this endpoint's URL

Headers:

X-Timestamp: current Unix time in seconds; must be within 300 seconds of server time. X-Signature: lowercase hex of HMAC-SHA256(key: "apibee-hmac-secret", message: X-Timestamp + "." + raw request body). An optional sha256= prefix is accepted. Bash: SIG=$(printf '%s' "$TS.$BODY" | openssl dgst -sha256 -hmac apibee-hmac-secret | awk '{print $NF}')

Note: X-Signature = hex(HMAC-SHA256("apibee-hmac-secret", X-Timestamp + "." + rawBody)); timestamp must be within 5 minutes. Each signature is accepted once: the identical request sent again within the 5-minute window gets 401 (replay refused).

HMAC-SHA256 request signature (X-Timestamp + X-Signature), secret apibee-hmac-secret

Parameters 2

Name	Type	Description
`X-Timestamp`required	header · string	Unix time in seconds; must be within 5 minutes of the server clock.
`X-Signature`required	header · string	Hex HMAC-SHA256 of "{X-Timestamp}.{raw body}" with secret apibee-hmac-secret (optional sha256= prefix).

Request body

Optional. application/json. Any body; it is covered by X-Signature.

Example body

{"event":"ping"}

Responses

200: Signature valid.
401: Headers missing, timestamp not numeric or outside the tolerance, signature mismatch, or a replayed signature.

Example

Request

curl -X POST "https://api.testingapis.com/api/auth/hmac" \
  -H "Content-Type: application/json" \
  -H "X-Timestamp: {{unixTimestamp}}" \
  -H "X-Signature: {{hmacSignature}}" \
  -d '{"event":"ping"}' \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{"authenticated": true, "scheme": "hmac-sha256", "timestamp": 1790792796, "bodyLength": 16}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl -X POST 'https://api.testingapis.com/api/auth/hmac' \
  -H 'X-Timestamp: {{unixTimestamp}}' \
  -H 'X-Signature: {{hmacSignature}}' \
  -H 'Content-Type: application/json' \
  -H 'X-TestingApis-Key: YOUR_API_KEY' \
  -d '{"event":"ping"}'

const res = await fetch("https://api.testingapis.com/api/auth/hmac", {
  method: "POST",
  headers: {
    "X-Timestamp": "{{unixTimestamp}}",
    "X-Signature": "{{hmacSignature}}",
    "Content-Type": "application/json",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: "{\"event\":\"ping\"}",
});
console.log(res.status, await res.text());

// The shape of the example response in the docs.
type ApiResponse = {
  authenticated: boolean;
  scheme: string;
  timestamp: number;
  bodyLength: number;
};

const res = await fetch("https://api.testingapis.com/api/auth/hmac", {
  method: "POST",
  headers: {
    "X-Timestamp": "{{unixTimestamp}}",
    "X-Signature": "{{hmacSignature}}",
    "Content-Type": "application/json",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: "{\"event\":\"ping\"}",
});
const body = (await res.json()) as ApiResponse;
console.log(res.status, body);

import requests

res = requests.post(
    "https://api.testingapis.com/api/auth/hmac",
    headers={
        "X-Timestamp": "{{unixTimestamp}}",
        "X-Signature": "{{hmacSignature}}",
        "Content-Type": "application/json",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
    data="{\"event\":\"ping\"}",
)
print(res.status_code, res.text)

using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.testingapis.com/api/auth/hmac");
request.Headers.TryAddWithoutValidation("X-Timestamp", "{{unixTimestamp}}");
request.Headers.TryAddWithoutValidation("X-Signature", "{{hmacSignature}}");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
request.Content = new StringContent("{\"event\":\"ping\"}");
request.Content.Headers.ContentType = MediaTypeHeaderValue.Parse("application/json");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/hmac"))
                .header("X-Timestamp", "{{unixTimestamp}}")
                .header("X-Signature", "{{hmacSignature}}")
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .header("Content-Type", "application/json")
                .method("POST", HttpRequest.BodyPublishers.ofString("{\"event\":\"ping\"}"))
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader("{\"event\":\"ping\"}")
	req, err := http.NewRequest("POST", "https://api.testingapis.com/api/auth/hmac", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-Timestamp", "{{unixTimestamp}}")
	req.Header.Set("X-Signature", "{{hmacSignature}}")
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

HMAC-SHA256 request signature (X-Timestamp + X-Signature), secret apibee-hmac-secret

{{unixTimestamp}}: The current Unix time, set when you send.

{{hmacSignature}}: HMAC-SHA256 of "{timestamp}.{body}" with apibee-hmac-secret, computed when you send.

POSThttps://api.testingapis.com/api/auth/hmac

Query

Headers

X-Timestamprequiredstring

X-Signaturerequiredstring