Security is a major concern for web applications and services that use the HTTP protocol. Although HTTP is a versatile protocol that can be used in many different platforms, it is vulnerable to security threats. Enter HMAC, or Hash-based Message Authentication Code, a widely used method of securing web APIs.
HMAC is a cryptographic authentication technique that uses a hash function together with a shared secret key, i.e., the key is known to both the server and the client. HMAC not only gives you authentication, but also verifies that the message hasn’t been changed in transit. Plus it is fast, lightweight, and stateless, with no secrets sent over the network and no need for token stores or session management.
In this post, we’ll examine how we can work with HMAC authentication in minimal APIs in ASP.NET Core. To use the code examples provided in this article, you should have Visual Studio 2022 or Visual Studio 2026 installed in your system. If you don’t already have a copy, you can download Visual Studio 2026 here.
What is HMAC authentication? How does it work?
Hash-based Message Authentication Code (HMAC) is a method of creating a message authentication code that uses a hash function and a symmetric key (i.e., a key used both to encrypt and decrypt the message). In HMAC authentication, the two entities that exchange a message share the symmetric key (i.e., the key is known to both the server and the client). The symmetric key is typically generated using a cryptographic random number generator and stored in a database.
