HMAC
Description
Pure function returning the keyed HMAC of the input text using the selected algorithm. Hex output is lowercase. Use this to verify signed webhooks (e.g. Stripe, GitHub, Shopify).
When to use
Use HMAC to verify the authenticity of signed webhooks. Providers like Stripe, GitHub, and Shopify sign each request by computing an HMAC of the raw body with a shared secret and sending the result in a header. Recompute the HMAC with the same secret and compare it to the header value to confirm the request is genuine and untampered. Unlike Hash, which computes a plain keyless digest, HMAC mixes in a secret key — a plain hash can never match a provider’s HMAC signature.
Pins
Input pins
| Pin | Type | Default | Notes |
|---|---|---|---|
| Text | string | — | The text to authenticate, typically the raw request body. |
| Key | string | — | The shared secret key. Must not be empty. |
| Algorithm | enum | HMAC_SHA256 | The HMAC algorithm to use. HMAC-SHA256 is the modern default used by most providers; HMAC-SHA1 is available for legacy compatibility. |
| Output format | enum | HEX | How to encode the digest. Hex matches Stripe and GitHub; Base64 matches Shopify and Slack. |
Output pins
| Pin | Type | Notes |
|---|---|---|
| Result | string | The HMAC digest, encoded as hex (lowercase) or Base64 per the selected output format. |
Example
Verify a Stripe-style webhook. Read the incoming HTTP body with Stream to string and wire the Value output into the Text input of HMAC. Set Key to your signing secret, Algorithm to HMAC-SHA256, and Output format to Hex. Feed the Result output into an Equals node alongside the signature from the request header to confirm they match before trusting the payload.