HMAC Verifier

Overview

You pass the message, shared secret, and signature; we recompute the HMAC and compare it in constant time. A mismatch is a successful result with valid=false — not an error. We never echo the key or return partial-match information. Do not use this for JWT validation, password verification, or provider-specific header parsing.

Signature verification written by hand is where authentication quietly breaks — ordinary string comparison leaks timing, and an agent cannot recompute an HMAC reliably.

When to use it

Scope

Non-goals

• Does not tell you why a signature failed beyond match / mismatch / length mismatch
• Does not return the expected signature, a matching-prefix length, or a byte offset
• Does not manage, derive, rotate, or store keys
• Does not check a timestamp, nonce, or replay window
• Does not parse provider-specific signature headers (use network.validate_webhook_signature)
• Does not verify asymmetric signatures (RSA, ECDSA, Ed25519) or JWTs

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.verify_hmac","input":{"message":"hello world","key":"secret","signature":"734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.verify_hmac", {"signature":"734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a","key":"secret","message":"hello world"});

Errors

Other limits

Limitations

• Does not tell you why a signature failed beyond match / mismatch / length mismatch
• Does not return the expected signature, a matching-prefix length, or a byte offset
• Does not manage, derive, rotate, or store keys
• Does not check a timestamp, nonce, or replay window
• Does not parse provider-specific signature headers (use network.validate_webhook_signature)
• Does not verify asymmetric signatures (RSA, ECDSA, Ed25519) or JWTs
• Verifying a JWT (use security.validate_jwt)
• Verifying a password (use security.password_verify)
• Parsing a provider-specific signature header format before comparison

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "security.verify_hmac",
  "input": {
    "signature": "734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a",
    "key": "secret",
    "message": "hello world"
  }
}

Examples

{
  "signature": "734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a",
  "key": "secret",
  "message": "hello world"
}

{
  "algorithm": "HMAC-SHA256",
  "valid": true,
  "reason": "match"
}

{
  "signature": "0000000000000000000000000000000000000000000000000000000000000000",
  "key": "secret",
  "message": "hello world"
}

{
  "algorithm": "HMAC-SHA256",
  "valid": false,
  "reason": "signature_mismatch"
}

Recommended use cases

• Check the signature on an inbound webhook before acting on its body
• Authenticate a signed API request received from a partner
• Confirm a message was not modified in transit over an untrusted channel

Avoid for

• Verifying a JWT (use security.validate_jwt)
• Verifying a password (use security.password_verify)
• Parsing a provider-specific signature header format before comparison

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags