Générateur de signature d'API

HMAC (Hash-based Message Authentication Code) authentication works by both parties sharing a secret key. The sender computes HMAC(secret, message) and sends the result as a signature header. The receiver independently computes the same HMAC and compares it to the received signature. Because only parties with the secret key can produce a valid signature, a matching HMAC proves authenticity and integrity of the message.

A plain SHA256 hash is deterministic and public — anyone can compute SHA256(data). HMAC-SHA256 incorporates a secret key into the computation using a two-pass construction: HMAC(k, m) = H((k ⊕ opad) || H((k ⊕ ipad) || m)). This means only parties with the secret key can produce or verify the signature, making it suitable for authentication where plain hashes are not.

Webhooks deliver HTTP POST requests from a server to your endpoint. Without authentication, any server could send fake events. HMAC signatures solve this: the webhook provider signs the payload with a shared secret, and your server re-computes the HMAC to verify authenticity before processing the event. GitHub, Stripe, Shopify, and most modern webhook systems use this pattern with HMAC-SHA256.

The message content varies by API. Common approaches include: signing just the request body (Stripe, GitHub webhooks), signing a canonical string of method + URL + timestamp + body (AWS Signature V4), or signing a sorted query string. Always check your API provider’s documentation for their exact canonical string format, as even whitespace differences will produce a different signature.