HMAC (Hash-based Message Authentication Code) secrets are the industry standard for webhook signatures, internal API authentication, and session tokens. They provide a fast, simple way to verify that a message hasn't been altered and came from a trusted source.
While services like Stripe, GitHub, and Slack make HMAC easy to consume, implementing it securely requires attention to detail. This guide covers how HMAC works, how to implement it correctly, and how to avoid common security pitfalls like timing attacks and hardcoded secrets.
What Is an HMAC Secret?
An HMAC secret is a shared cryptographic key used to generate and verify message authentication codes. These act as a digital signature that proves a message hasn't been modified and originated from a trusted source.
Unlike public-key cryptography (which uses two different keys), HMAC uses a single symmetric key known only to the sender and receiver. This secret is a high-entropy value (usually a 256-bit random string) that requires special caution. Combined with the message (the raw data being authenticated, e.g., a webhook payload or API body), it gets hashed through a cryptographic algorithm like SHA-256 to produce the signature.
