What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a signature. It proves a message was not altered and came from someone who holds the key.

HMAC is widely used to sign API requests and webhooks (e.g. HMAC-SHA256). Unlike a plain hash, an attacker cannot forge a valid HMAC without the secret key.