HMAC-SHA256 combines a shared secret key with SHA-256 to protect data integrity and authenticate its creator. A warehouse service can generate a refund file and a payments service can verify that the file was produced by a trusted partner and was not modified. section 4.6
A practical validation flow is:
- The producer computes HMAC-SHA256 over the exact file contents and sends the result alongside the file. section 4.6
- The consumer recomputes the HMAC with the shared secret and rejects missing or mismatched values before parsing or processing the data. section 4.6
- Both services must possess the same secret; agreeing on and protecting that key remains an operational responsibility. section 4.6
HMAC-SHA256 in JWS
JWS names HMAC-SHA256 as HS256. The signature covers the encoded header and payload, allowing recipients to detect alteration, while the payload remains readable rather than confidential. section 11.4.1
