Cryptology Academy · Lesson

HMAC in APIs: Request Signing

Implement HMAC-based request signing and replay-attack prevention.

Lesson 3 of 413 steps

HMAC in APIs: Request Signing is a free Cryptology Academy lesson on CoddyKit. This is lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

HMAC-based request signing is used by AWS, GitHub, Stripe, and Twilio to authenticate API calls. In this lesson we build a complete request signing system.

Why API Request Signing?

API keys in URLs can be logged in proxy servers, browser history, and server logs. Request signing includes the full request body in the MAC — ensuring the payload wasn't modified and the key isn't exposed alone.

AWS Signature Version 4

AWS SigV4 computes: 1. Canonical request (method + URL + headers + body hash) 2. String to sign (date + region + service + canonical request hash) 3. Signing key = HMAC(HMAC(HMAC(HMAC('AWS4'+secret, date), region), service), 'aws4_request') 4. Signature = HMAC(signing_key, string_to_sign)

GitHub Webhook Verification

GitHub signs each webhook payload: X-Hub-Signature-256: sha256=HMACHEX Verify: import hmac expected = 'sha256=' + hmac.new(secret, payload, 'sha256').hexdigest() hmac.compare_digest(expected, received_signature)

Replay Attack Threat

If an attacker captures a valid signed request, they can resend it multiple times. A transfer of $100 signed once could be replayed 1000 times. HMAC alone does NOT prevent replays.

Timestamp-Based Replay Prevention

Include a timestamp in the signed message. Reject requests older than 5 minutes. Stripe sends X-Stripe-Signature with timestamp. GitHub uses X-GitHub-Delivery (UUID), not timestamp-based.

Nonce-Based Replay Prevention

Include a random nonce in each request. Server stores used nonces (in Redis with TTL). Reject any request with a previously seen nonce. More reliable than timestamps for distributed systems.

Request Signing Implementation

import hmac, hashlib, time, os def sign_request(secret, method, path, body, timestamp=None): ts = timestamp or str(int(time.time())) payload = f'{method}\n{path}\n{ts}\n' + hashlib.sha256(body).hexdigest() sig = hmac.new(secret.encode(), payload.encode(), 'sha256').hexdigest() return ts, sig

Server-Side Verification

def verify_request(secret, method, path, body, ts, received_sig): # Check timestamp freshness if abs(time.time() - int(ts)) > 300: # 5 minutes return False # Recompute and compare _, expected = sign_request(secret, method, path, body, ts) return hmac.compare_digest(expected, received_sig)

JWT with HMAC (HS256)

HS256 JWTs use HMAC-SHA256 with a shared secret. The server both signs and verifies. Limitation: any party with the key can forge tokens. For asymmetric trust (third-party auth), use RS256 or ES256.

Key Rotation Strategy

Rotate HMAC keys periodically: generate new key, support both old and new during transition window (24 hours), then retire old key. AWS SigV4 derives keys from dated secrets to enable daily rotation.

Quick Check

Why is HMAC request signing insufficient alone to prevent replay attacks?

Answer it in the interactive lesson

Recap

HMAC request signing with replay protection implemented. Next we compare CMAC and Poly1305 as block-cipher-based MAC alternatives.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “HMAC in APIs: Request Signing” lesson free?

Yes — the full text of “HMAC in APIs: Request Signing” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “HMAC in APIs: Request Signing”?

Implement HMAC-based request signing and replay-attack prevention. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.

How long does the “HMAC in APIs: Request Signing” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy