HMAC Generator API

POST

Sign payloads and verify webhooks with standard HMAC hashes.

HMAC Generator creates Hash-based Message Authentication Codes for data integrity and authentication. Supports SHA-256, SHA-384, SHA-512, SHA-1, and MD5 algorithms.

Try it — live request, no key required

Request

POSTapi.apiverve.com/v1/hmac

Body

messagestring

secretstring

Verification

Format

No key required to try it. Get a key to use it in your app.

Example

{
  "status": "ok",
  "error": null,
  "data": {
    "hmac": "2cd7c25025198d4458002ceb064ad37ccfbbe46650876d693f5e080bd954e449",
    "algorithm": "sha256",
    "encoding": "hex"
  }
}

About the HMAC Generator API

Returns the HMAC signature in hex or base64 encoding. Use for signing API requests, validating webhooks, or any scenario requiring message authentication.

What people use it for

API Authentication: Sign API requests to prove authenticity
Webhook Verification: Validate incoming webhooks from services like Stripe, GitHub
Data Integrity: Ensure messages haven't been tampered with
JWT Signing: Generate signatures for JSON Web Tokens

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON: Default REST response
XML: Markup format
YAML: Human-readable
CSV: Tabular export
GraphQL: Query language
MCP: For AI agents

View all integrations →

Other ways to use HMAC Generator

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit

Questions.

Common questions about the HMAC Generator API.

Read the docs →

Which hashing algorithms can I use to generate signatures?

You can generate signatures using SHA-256, SHA-384, SHA-512, SHA-1, and MD5. This allows you to match the exact algorithm required by your webhook receiver, API provider, or legacy service.

Which output encoding formats are supported?

The API supports both hex and base64 output formats. Specify the encoding you need in your request to receive the signature formatted for your authorization headers or verification checks.

Can I use this to sign webhook payloads and JWTs?

Yes. HMAC Generator is designed for API authentication, webhook signature generation, data integrity verification, and JWT signing workflows.

Can I pass structured payloads like JSON strings into the message?

Yes. Any string data can be passed as the message, including serialized JSON payloads, raw URL query strings, and custom tokens.

How many signatures does the Free plan cover?

The Free plan includes 200 monthly credits, which covers 100 signatures at 2 credits per call. For higher volumes, the Starter plan covers up to 100,000 signatures per month, which works out to about $0.30 per 1,000 calls.

Request parameters — POST /v1/hmac

Sent as JSON in the request body. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

Parameter	Type	Example	Description
`message`Required	string	`Hello World`	The message to sign
`secret`Required	string	`my-secret-key`	The secret key for HMAC generation

Optional

Parameter	Type	Example	Description
`algorithm`Optional	string	`sha256`	Hash algorithm to use `sha256sha384sha512sha1md5` default sha256
`encoding`Optional	string	`hex`	Output encoding format `hexbase64` default hex

Example request

curl -X POST "https://api.apiverve.com/v1/hmac" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message":"Hello World","secret":"my-secret-key","algorithm":"sha256","encoding":"hex"}'

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Header	When	Value
`x-api-key`Required	Every request	Your API key. Header names are case-insensitive, so `X-API-Key` is the same header.
`Authorization`Alternate	Instead of the above	`Bearer <key>` — for clients that only expose bearer auth. Resolves to the same account and the same billing.
`content-type`Required	POST body	`application/json`

401 is the only auth verdict

A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.

Response — POST /v1/hmac

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

Sample response

{
  "status": "ok",
  "error": null,
  "data": {
    "hmac": "2cd7c25025198d4458002ceb064ad37ccfbbe46650876d693f5e080bd954e449",
    "algorithm": "sha256",
    "encoding": "hex"
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`hmac`	string	`"2cd7c25025198d4458002ceb064ad37ccfbbe46650876d693f5e080bd954e449"`	Generated HMAC signature in specified encoding format
`algorithm`	string	`"sha256"`	Hash algorithm used for HMAC generation
`encoding`	string	`"hex"`	Output encoding format applied to the signature

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Header	What it carries
`x-api-remaining-credits`	Credits left in the current cycle
`x-api-credits-used`	Credits spent in the current cycle
`x-api-max-credits`	The allowance for the cycle
`x-api-version`	Version of the endpoint that answered

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

Status	Meaning	What to do
`400`	Input was rejected	Read `error`; it names the parameter that has to change.
`401`	Key missing or invalid	Check the header name and the key value.
`403`	Key valid, but not permitted here	A key restriction or an IP allow-list — never a bad key.
`429`	Rate limited, or out of credits	Read `error` to tell them apart, then back off or top up.

What a call costs — 2 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Plan	Per month	Credits	HMAC Generator calls	Per 1,000 calls
Free	Free	200	100	Free
Starter	$29.99	200,000	100,000	$0.30
Pro	$99.99	1,000,000	500,000	$0.20
Mega	$299.99	4,000,000	2,000,000	$0.15

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Compare all pricing tiers →

Call it from cURL — POST /v1/hmac

No SDK to install — this is a plain HTTPS call to /v1/hmac with your key in the x-api-key header. Swap in a real key and it runs as-is.

cURL

1
2

curl "https://api.apiverve.com/v1/hmac" \
  -H "x-api-key: YOUR_API_KEY"

Resources

GitHubapiverve/hmac-apiSource, issues and the examples this page is built from.ReferenceHMAC Generator API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/hmacnpm APIVerve.API.HMACGeneratorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Node.js — POST /v1/hmac

Install the Node.js SDK, then call the HMAC Generator API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — npm

npm install @apiverve/hmac

Node.js

const res = await fetch("https://api.apiverve.com/v1/hmac", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Resources

npm@apiverve/hmacThe published Node.js client, versioned and signed.GitHubapiverve/hmac-apiSource, issues and the examples this page is built from.ReferenceHMAC Generator API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

APIVerve.API.HMACGeneratorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Python — POST /v1/hmac

No SDK to install — this is a plain HTTPS call to /v1/hmac with your key in the x-api-key header. Swap in a real key and it runs as-is.

Python

import requests

res = requests.get(
    "https://api.apiverve.com/v1/hmac",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(res.json()["data"])

Resources

Also published for

@apiverve/hmacnpm APIVerve.API.HMACGeneratorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from C# / .NET — POST /v1/hmac

Install the C# / .NET SDK, then call the HMAC Generator API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — NuGet

dotnet add package APIVerve.API.HMACGenerator

C# / .NET

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", "YOUR_API_KEY");

var json = await client.GetStringAsync("https://api.apiverve.com/v1/hmac");
Console.WriteLine(json);

Resources

NuGetAPIVerve.API.HMACGeneratorThe published C# / .NET client, versioned and signed.GitHubapiverve/hmac-apiSource, issues and the examples this page is built from.ReferenceHMAC Generator API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/hmacnpm

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Go — POST /v1/hmac

No SDK to install — this is a plain HTTPS call to /v1/hmac with your key in the x-api-key header. Swap in a real key and it runs as-is.

req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/hmac", nil)
req.Header.Set("x-api-key", "YOUR_API_KEY")

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))

Resources

Also published for

@apiverve/hmacnpm APIVerve.API.HMACGeneratorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from PHP — POST /v1/hmac

No SDK to install — this is a plain HTTPS call to /v1/hmac with your key in the x-api-key header. Swap in a real key and it runs as-is.

PHP

$ch = curl_init("https://api.apiverve.com/v1/hmac");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-api-key: YOUR_API_KEY"]);

$response = curl_exec($ch);
echo $response;

Resources

Also published for

@apiverve/hmacnpm APIVerve.API.HMACGeneratorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Ruby — POST /v1/hmac

No SDK to install — this is a plain HTTPS call to /v1/hmac with your key in the x-api-key header. Swap in a real key and it runs as-is.

Ruby

require "net/http"

uri = URI("https://api.apiverve.com/v1/hmac")
req = Net::HTTP::Get.new(uri)
req["x-api-key"] = "YOUR_API_KEY"

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Resources

Also published for

@apiverve/hmacnpm APIVerve.API.HMACGeneratorNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

All articles →

API Security Checklist: 15 Pre-Production ChecksA no-fluff checklist of security basics to review before your API integration goes live. Print it, pin it, check it off.Read

API Authentication Best Practices in 2026Stop overthinking auth. API keys for servers, OAuth for users, JWTs for stateless. Here's what actually matters.Read

Extract Clean Content from Any WebpageTurn messy web pages into clean Markdown. Perfect for content migration, archiving, AI training data, and building read-later tools.Read

HMAC Generator API

Try it — live request, no key required

About the HMAC Generator API

What people use it for

Ways to call it

Other ways to use HMAC Generator

Questions.

Request parameters — POST /v1/hmac

Required

Optional

Authentication

Response — POST /v1/hmac

Response fields

Response headers

Errors

What a call costs — 2 credits per call

Call it from cURL — POST /v1/hmac

Resources

Also published for

Call it from Node.js — POST /v1/hmac

Resources

Also published for

Call it from Python — POST /v1/hmac

Resources

Also published for

Call it from C# / .NET — POST /v1/hmac

Resources

Also published for

Call it from Go — POST /v1/hmac

Resources

Also published for

Call it from PHP — POST /v1/hmac

Resources

Also published for

Call it from Ruby — POST /v1/hmac

Resources

Also published for

Zero-code embed — one snippet, no backend

Changelog — HMAC Generator API

Security

Related articles

Ready to build with HMAC Generator? Start with 200 free credits — one key unlocks all 300+ APIs.

Explore the catalog