sec-hmac-sign Edge Function — Security

sec-hmac-sign — Sign payloads with HMAC

Creates an HMAC-SHA256 or HMAC-SHA512 signature for any string payload using the Web Crypto API — output is hex-encoded.

---

API

POST /api/sec-hmac-sign

Request body

Field	Type	Required	Default	Description
payload	string	✅	—	The string to sign
secret	string	✅	—	Shared HMAC secret
algorithm	"SHA-256" | "SHA-512"	❌	"SHA-256"	Hash algorithm

Success response (200)

{
  "success": true,
  "data": {
    "signature": "b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576e9caefd1b8..."
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing payload or secret
INTERNAL_ERROR	500	Unexpected error

---

Usage

cURL

curl -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/json" \
  -d '{"payload": "{\"event\":\"order.created\",\"id\":\"ord_123\"}", "secret": "webhook-secret"}'

TypeScript / JavaScript (HTTP)

const body = JSON.stringify(webhookPayload);
const response = await fetch(FUNCTION_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ payload: body, secret: WEBHOOK_SECRET }),
});
const { data } = await response.json();
// Attach data.signature as X-Signature header

Direct import (Node / Bun / Deno)

import { hmacSign } from '@aerostack/functions/sec-hmac-sign';

const { signature } = await hmacSign({ payload: body, secret: process.env.HMAC_SECRET! });

---

Use Cases

• Signing outbound webhook payloads so receivers can verify authenticity
• Creating request signatures for API authentication (like AWS SigV4 style)
• Generating tokens to verify email links or password reset URLs
• Signing data before storing it to detect tampering on read

---

Notes

• SHA-256 produces 64 hex characters (32 bytes); SHA-512 produces 128 hex characters (64 bytes)
• Deterministic — same payload + secret always yields the same signature
• Use sec-hmac-verify for timing-safe verification on the receiver side
• Never use string equality for signature comparison — always use sec-hmac-verify