HMAC sign

POST /api/hmac-sign1 quota unit per call · cache hits free

Compute HMAC signatures over an HTTP API. SHA-1, SHA-256, SHA-384, or SHA-512 with a shared secret. Returns the signature in hex, standard base64, and URL-safe base64 — match whichever your verifier expects.

Computes a Message Authentication Code (HMAC) over arbitrary input using a shared secret. The output value is the same one your verifier will recompute on its side — match the bytes and the message is authenticated. Common use cases: - **Webhook signing** — Stripe, GitHub, Slack, Twilio etc. all attach an HMAC over the payload so receivers can confirm it was not tampered with. - **Request signing** — AWS Sigv4, S3 presigned URLs, and many internal RPC schemes use HMAC over a canonical request representation. The output is returned in three encodings (hex, standard base64, URL-safe base64) so you can match whatever your verifier expects without re-encoding.

Inputs

Name	Type	Default	Description
data*	string	—	Message to sign (UTF-8 string by default; base64 if dataFormat=base64).
secret*	string	—	Shared secret (UTF-8 string by default; base64 if secretFormat=base64).
algorithm	enum (SHA-1 \| SHA-256 \| SHA-384 \| SHA-512)	"SHA-256"	Hash algorithm.
dataFormat	enum (text \| base64)	"text"	How `data` is encoded. `text` = UTF-8; `base64` for binary inputs.
secretFormat	enum (text \| base64)	"text"	How `secret` is encoded. `text` = UTF-8; `base64` for binary keys.

Response

Modes: json. Cache: yes (24h TTL).

Every response carries x-cache (HIT / MISS / BYPASS), x-cache-signature (stable across identical inputs), and the rate-limit headers listed below.

Quota & limits

Cost per call	1 unit against the 10,000-unit monthly quota. Cache hits are free — only cache misses decrement.
Burst limit	200 requests per rolling minute, shared across all tools.
Max request size	`16 MiB` (base64 inflates file payloads ~33% — the limit applies to the decoded bytes).
Max response size	`8 KiB`
Timeout	5s wall clock.
Rate-limit headers	`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Burst-Limit` on every response; `X-Quota-Warning` once 80% of the monthly quota is spent; `Retry-After` on 429s.

Errors

Errors are JSON with an error string; schema failures add a details object (Zod's flattened field errors).

Status	When	Body
400	Input fails the tool's schema (wrong type, missing required field, malformed base64) or the file bytes can't be parsed as the expected format.	{ "error": "invalid inputs", "details": { "fieldErrors": { … } } }
401	Missing or invalid X-Api-Key / X-Account-Id headers (or no session when called from the browser).	{ "error": "unauthorized" }
404	Unknown tool id, or calling /api/* on the website hostname instead of api.xtract.bot.	{ "error": "not found" }
413	Request body over the tool's max request size, or an image header declaring more megapixels than the tool's pixel budget.	{ "error": "…exceeds maxRequestBytes…" }
415	Content-Type isn't application/json on the json-body transport.	{ "error": "unsupported content-type; expected application/json" }
429	Monthly quota or the 200/min burst limit exhausted. Check Retry-After and the X-RateLimit-* headers.	{ "error": "monthly quota exceeded", "monthRemaining": 0, … }
5xx	Conversion engine failure. Safe to retry; if it persists, the input is hitting a bug — please report it.	{ "error": "…" }

Code samples

Built from the sha256-default example.


curl -X POST https://api.xtract.bot/api/hmac-sign \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "X-Account-Id: $XTRACT_ACCOUNT_ID" \
  -H "X-Api-Key: $XTRACT_API_KEY" \
  -d '{
  "data": "{\"event\":\"order.created\",\"id\":\"ord_123\"}",
  "secret": "whsec_replace_me_in_production"
}'