Home/Blockchain/HMAC & Message Authentication/Building Hmac

🛠️ Build Your Own HMAC

Create HMAC signatures step-by-step and verify message authenticity

Your Progress

0 / 5 completed
1
2
3
4
5
←
Previous
How HMAC Works

🔨 Building HMAC Signatures

Let's build real HMAC signatures like those used by cryptocurrency exchanges! This is exactly how Binance, Coinbase, and others secure their APIs.

🎮 Interactive API Request Signer

Configure your API request below and watch as we generate a secure HMAC signature in real-time!

🔑 Step 1: API Credentials
This is sent in the request header
⚠️ Never transmitted! Used only to sign
📝 Step 2: Request Details
Prevents replay attacks
🔧 Step 3: Build Signature Payload
Concatenated String:
1768552205989POST/api/v1/order{"symbol":"BTC","amount":1.5}
Formula: timestamp + method + path + body
✨ Step 4: Generate HMAC Signature

📤 Complete HTTP Request with HMAC

Here's what the final authenticated request looks like:

POST /api/v1/order HTTP/1.1
Host: api.exchange.com
Content-Type: application/json
X-Timestamp: 1768552205989
{"symbol":"BTC","amount":1.5}

🔍 Server Verification Process

When the server receives your request, it:

1️⃣
Lookup Secret Key

Uses your API Key to find the corresponding Secret Key in its database

2️⃣
Rebuild Payload

Concatenates timestamp + method + path + body exactly as you did

3️⃣
Compute HMAC

Generates its own signature using the Secret Key and payload

4️⃣
Compare Signatures

If server's signature matches yours: ✅ Request accepted!

If different: ❌ Request rejected (tampering detected)

💻 Code Implementation Example

Python (using hmac library):
import hmac
import hashlib
import time

# Your credentials
api_secret = "your_secret_key"
timestamp = str(int(time.time() * 1000))

# Build payload
payload = timestamp + "POST" + "/api/v1/order" + '{"symbol":"BTC","amount":1.5}'

# Generate HMAC signature
signature = hmac.new(
    api_secret.encode('utf-8'),
    payload.encode('utf-8'),
    hashlib.sha256
).hexdigest()

# Add to request headers
headers = {
    "X-API-Key": "your_api_key",
    "X-Timestamp": timestamp,
    "X-Signature": signature
}

⚡ Pro Tips for Production

✓
Use Timestamp Validation

Reject requests older than 5 minutes to prevent replay attacks

✓
Include Request ID

Add unique nonce to prevent identical request replays

✓
Rotate Keys Regularly

Change API secrets every 90 days for better security

✓
Use Constant-Time Comparison

Prevents timing attacks when comparing signatures