HMAC Generator

Overview

You pass a message and secret key; we compute a keyed message authentication code using HMAC-SHA256 (default), HMAC-SHA384, or HMAC-SHA512. Message and key may be utf8, hex, or base64; the signature is returned as hex, base64, or base64url. The key is never echoed, logged, or referenced in any output or error. Do not use this to verify an inbound signature (use security.verify_hmac) or hash passwords (use security.password_hash).

An LLM cannot compute an HMAC. Producing one requires exact byte-level keyed hashing, and a fabricated value is indistinguishable from a wrong one until verification fails somewhere expensive.

When to use it

Scope

Non-goals

• Does not manage, derive, rotate, or store keys
• Does not encrypt — HMAC authenticates, it does not provide confidentiality
• Does not verify a signature (use security.verify_hmac)
• Does not truncate the code, and does not offer HMAC-SHA1 or HMAC-MD5
• Does not produce asymmetric signatures (RSA, ECDSA, Ed25519)
• Does not sign with a platform-managed secret (use crypto.squillify_signature)

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.generate_hmac","input":{"message":"hello world","key":"secret"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.generate_hmac", {"message":"hello world","key":"secret"});

Errors

Other limits

Limitations

• Does not manage, derive, rotate, or store keys
• Does not encrypt — HMAC authenticates, it does not provide confidentiality
• Does not verify a signature (use security.verify_hmac)
• Does not truncate the code, and does not offer HMAC-SHA1 or HMAC-MD5
• Does not produce asymmetric signatures (RSA, ECDSA, Ed25519)
• Does not sign with a platform-managed secret (use crypto.squillify_signature)
• Hashing a password (use security.password_hash — HMAC is not a password hash)
• Encrypting data (HMAC is one-way authentication, not encryption)
• Verifying an inbound webhook (use network.validate_webhook_signature or security.verify_hmac)

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "security.generate_hmac",
  "input": {
    "message": "hello world",
    "key": "secret"
  }
}

Examples

{
  "message": "hello world",
  "key": "secret"
}

{
  "messageBytes": 11,
  "signatureBits": 256,
  "algorithm": "HMAC-SHA256",
  "signature": "734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a",
  "outputEncoding": "hex"
}

{
  "keyEncoding": "hex",
  "key": "4a656665",
  "algorithm": "HMAC-SHA256",
  "message": "what do ya want for nothing?",
  "outputEncoding": "base64url"
}

{
  "messageBytes": 28,
  "signatureBits": 256,
  "algorithm": "HMAC-SHA256",
  "signature": "W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM",
  "outputEncoding": "base64url"
}

Recommended use cases

• Sign an outbound webhook payload before delivering it
• Produce a request signature for an API that expects HMAC authentication
• Generate an integrity tag for a message travelling over an untrusted channel

Avoid for

• Hashing a password (use security.password_hash — HMAC is not a password hash)
• Encrypting data (HMAC is one-way authentication, not encryption)
• Verifying an inbound webhook (use network.validate_webhook_signature or security.verify_hmac)

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags