ForHosting KIT · Developer Utilities

Sign and verify a payload

Every webhook, API key exchange or internal message queue that claims to be tamper-proof rests on one primitive: a keyed hash. The HMAC API signs or verifies a payload against a secret you control, so your services can trust that a message came from where it says it came from and wasn't altered in transit.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Why a keyed hash beats a plain checksum

A regular hash like SHA-256 proves a message wasn't corrupted, but anyone can compute one, including an attacker forging a request. HMAC mixes a shared secret into the hashing process, so only someone holding that secret can produce a signature that verifies. That single distinction is why HMAC sits at the center of webhook authentication, signed URLs, OAuth token integrity and inter-service trust across almost every API-driven company.

What the endpoint actually does

Send POST /dev/hmac with a payload, a secret and a chosen algorithm (SHA-256, SHA-384 or SHA-512), and tell it whether you want a signature generated or an existing one checked. The task runs asynchronously: you get a task_id immediately, and the result — a hex or base64 digest, or a simple valid/invalid verdict — lands via signed webhook or a signed link you can fetch for 24 hours.

A little history that still matters

HMAC was formalized in RFC 2104 back in 1996 and later standardized as FIPS 198, precisely because early attempts at keying a hash function by simple concatenation turned out to be exploitable. The construction survived three decades of cryptanalysis largely unscathed, which is why it remains the default choice for message authentication instead of something newer and less battle-tested.

Where it plugs into your stack

Teams call this endpoint from webhook senders that need to sign outgoing payloads, from receivers validating an inbound webhook against a shared secret, from queue workers stamping messages before they hit a broker, and from CI pipelines that sign release artifacts. Because it is stateless and async, it drops into existing automation without you having to manage a cryptography library, key rotation code or timing-safe comparison logic yourself.

What to expect on delivery

Every response includes the algorithm used and the resulting digest or verification result, nothing more, nothing retained. A failed task, such as a malformed payload, is never billed — the API retries transient failures automatically up to three times before returning a clear, actionable error.

What you can do with it

Webhook senders

Sign each outgoing webhook payload before delivery so receivers can confirm it genuinely came from your system.

Inbound webhook validation

Verify the signature header on webhooks you receive from third parties before trusting the body.

Signed URLs

Generate an HMAC over a URL's query parameters to create tamper-evident download or reset links with an expiry baked in.

Message queue integrity

Stamp messages with an HMAC before publishing to a queue so consumers can reject anything altered in transit.

FAQ

What is an HMAC signature used for?

It proves both that a message wasn't altered and that it came from someone holding the shared secret, which is why it's the standard for webhook and API authentication.

Which algorithms does the HMAC API support?

SHA-256, SHA-384 and SHA-512, selectable per request depending on the security margin your system requires.

Is there a free tier for the HMAC signature API?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

How much does it cost to sign or verify a payload?

$0.002 per request, with no separate charge for verification versus signing, and failed tasks are never charged.

Do you store my secret key?

No. The secret you send is used only to compute or check the signature for that single request and is discarded once the task completes.

Can I use this to verify webhooks from other providers?

Yes. As long as you know the algorithm and shared secret the provider uses, POST /dev/hmac can validate the signature header on any incoming payload.

How do I get the result back?

Either through a signed webhook callback, recommended for automated pipelines, or a signed link that stays valid for 24 hours before the result is deleted.

Is HMAC still considered secure in 2026?

Yes, HMAC paired with SHA-256 or stronger remains a recommended construction; its security depends on keeping the secret private and choosing an adequately long key.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/hmac

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/hmac \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/dev/hmac", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/hmac",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/hmac", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/hmac", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.hmac",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free