API Signature Generator
The API Signature Generator builds the signature your backend expects. It supports common schemes such as HMAC-SHA256 over a canonical string, helping you debug auth errors without reading vendor SDKs.
Key Features
- HMAC-SHA1/256/512 signatures
- Configurable secret and nonce
- Shows the signed string
- Multiple preset schemes
- Local only
Use Cases
- Debug a 401 from a signed API
- Reproduce a server-side signature
- Teach API signing
- Test webhook authenticity
How to Use
- Select the signing scheme
- Enter the secret and the payload
- Adjust the canonical format
- Copy the resulting signature
Practical Tips
- Whitespace and ordering in the canonical string matter
- Keep secrets out of logs and commits
- Verify the server uses the same hash
FAQ
- HMAC vs raw hash?
- HMAC keys the hash so it cannot be forged without the secret.
- Why do signatures mismatch?
- Usually a trailing newline or different param order.