HMAC Header Examples For Signed Requests
Use HMAC header examples to build signed request notes with method, path, timestamp, body hash, and placeholder secrets.
Build the canonical string visibly
Signed requests are easier to debug when the method, path, timestamp, selected headers, and body hash are written before the digest is generated.
- Use the exact method and path that the server expects.
- Keep timestamp format and timezone clear.
- Hash the same body bytes that will be sent.
Share examples without sharing secrets
A useful HMAC example can show the header names and placeholder digest format without exposing the real signing key.
- Use <secret> or a test-only value in examples.
- Label hex and base64 digest formats clearly.
- Regenerate the signature after any request field changes.
Reference Blocks
Use these short blocks as starting notes before opening the calculator.
Signed header note
Method: POST Path: /v1/orders Timestamp: 2026-06-07T12:00:00Z Body hash: sha256=<hash> Signature: hmac-sha256=<digest> Headers: X-Timestamp, X-Signature
Canonical checklist
Part | Common mismatch Method | POST vs GET Path | includes query or not Body | formatted vs raw Digest | hex vs base64 Secret | test vs production
Worked Examples
Signed POST
A POST request signs method, path, timestamp, and body hash.
Generate timestamp and signature headers from the same canonical string.
If the body changes, the body hash and signature must change too.
Query string choice
The endpoint has ?page=2 in the URL.
Check whether the provider includes query parameters in the signed path.
Different APIs define canonical paths differently.
Digest encoding
The server expects base64 but the client sends hex.
Use the encoding required by the documentation.
The same bytes can be represented in different string formats.
Common Mistakes
- Signing a formatted body but sending a compact body.
- Using production secrets in shared examples.
- Forgetting to include required signed headers in the final request.
When This Is Not Enough
- HMAC rules differ by provider; follow the documented canonical string.
- This guide does not store, verify, or manage real secrets.
- Clock skew and replay windows may affect server acceptance.