HMAC is a message authentication code that combines a shared secret key with a hash function, such as SHA-256. The client and server use it to produce and check a digest for an API request. section 7.1
The digest authenticates the request when both sides know the secret. Depending on the API design, the digest can cover elements such as the URL, payload, and headers. HMAC authenticates data; it does not make JWT claims unreadable. section 7.1 section 7.2.2
HMAC in a JWT
A JWT using the HS256 algorithm signs the base64url-encoded header and payload joined by a dot. HS256 means HMAC-SHA256: HMAC applies a secret key to that signing input and produces the token signature. With the example secret password, the resulting signature is part of the JWT. section 7.2.2
Keep these distinctions clear when evaluating HMAC-based authentication:
- Use HMAC as an authentication method alongside access tokens, API keys, cookies, and mTLS; it is not the same as authorization. section 7.1
- Treat the secret as shared by the client and server, while treating the digest as derived from the request data. section 7.1
- Use encryption when JWT claims must not be inspectable; HMAC signing protects integrity and authenticity but does not hide the claims. section 7.2.2
