Request signing (HMAC)
Attaching a cryptographic signature to a message with a shared secret, so the receiver can prove it is genuine and wasn't altered on the way.
Updated October 2026 · with examples from our own builds
What does request signing mean in practice?
With HMAC signing, sender and receiver share a secret. The sender computes a signature over the message, often including a timestamp, and the receiver recomputes it; if they match, the message is authentic and unchanged. Payment gateways sign their webhooks this way, and products use it between their own services.
Signing is what makes an open URL safe to expose. Without it, anyone who learns a webhook address can send fake payment confirmations.
It breaks in the details. The signature must cover the exact raw bytes received, comparisons must be constant-time, old timestamps must be refused so messages can't be replayed, and key rotation needs a window in which two keys work.
Request signing at a glance
- Protects
- Webhooks and service-to-service calls
- Must cover
- The exact raw request body, plus a timestamp
- Plan for
- Key rotation with two keys valid at once
Where has request signing come up in our builds?
Each post sent to a customer's receiver kit is signed with HMAC-SHA256 over the method, the path, a timestamp, a nonce and a hash of the exact body. Timestamps more than five minutes out are refused, two keys are accepted during rotation, and a conformance script sends oddly spaced JSON to catch receivers that verify parsed JSON instead of the raw body.
Razorpay payment signatures are checked with HMAC-SHA256 before a registration is created.
When staff hide a reported post, the admin console calls an HMAC-signed internal endpoint on the app's backend rather than writing to user collections itself.
Common questions about request signing
Why do signatures fail even with the right secret?
Usually because the receiver verifies a re-serialised copy of the body instead of the raw bytes, so spacing or key order differs. Verify before any JSON parser touches the request.
How do I rotate a signing secret without downtime?
Accept both the old and the new secret for a short window, move the sender to the new one, then retire the old. AlwaysLoud's receiver kit accepts two keys during rotation for this reason.
Related terms
Sources
Planning a product and not sure where request signing fits? Ask us, or browse all 116 terms in the glossary.