← Back to Labs
HMAC Request Signing
Watch the client canonicalise a request, sign it, and then see tampering, stale timestamps, or nonce reuse break verification.
signature
mismatch after recompute
timestamp
inside 5 minute window
nonce
first use accepted
verdict
request rejected
client signed
POST /v1/transfers
computing
query
from=wallet-eur&to=vendor-berlin
host
api.example.eu
signed headers
content-type · host · x-date · x-nonce · x-content-sha256
body
{"amount":"125.00","currency":"EUR","reference":"invoice-1842"}
server received
POST /v1/transfers
computing
query
from=wallet-eur&to=vendor-berlin
host
api.example.eu
signed headers
content-type · host · x-date · x-nonce · x-content-sha256
body
{"amount":"125.00","currency":"EUR","reference":"invoice-1842"}
canonical request
Computing canonical request…
string to sign
Computing string to sign…
body hash: computing
signed headers: computing
request hash: computing
Request conditions
Nothing changed after the client signed the request.
Step 1 / 6Pick the exact request fields the signature must cover
Nothing changed after the client signed the request. HMAC signing only protects the fields that enter the canonical request, so the first job is deciding which bytes count.
Arrow keys to navigate · R to reset
Tap dots to jump to any step