HMAC — hash-based message authentication code — combines a secret key with a message under a hash function to produce a short value that can only be reproduced by someone who has the same key and the same message. It gives you authenticity and integrity together, without public-key cryptography.
The sender computes HMAC(secret, body) and puts the result in a header. The receiver computes the same thing over the body it received and compares. If either the body or the key differs, the values do not match. The comparison must be constant-time: a normal string comparison returns early on the first differing byte, which leaks enough timing information to reconstruct a valid signature given enough attempts.
That a signature proves freshness. It does not — a valid signed payload stays valid forever, so an attacker who captures one can replay it. That is why signatures are normally computed over a timestamp as well as the body, and why receivers reject anything older than a few minutes.
Trigger a webhook delivery and verify `x-funapi-signature` against the secret you were given at subscription time. Change one byte of the payload and the verification fails, which is the whole point.
All glossary terms · Testing techniques · All 39 mock REST APIs