<commit_before>---
id: page-plugin
title: Plugins - HMAC Authentication
header_title: HMAC Authentication
header_icon: /assets/images/icons/plugins/hmac-authentication.png
breadcrumbs:
  Plugins: /plugins
nav:
  - label: Getting Started
    items:
      - label: Installation
      - label: Configuration
  - label: Usage
    items:
      - label: Create a Consumer
      - label: Create a Credential
      - label: Upstream Headers
---

Add HMAC Signature Authentication to your APIs to establish the identity of the consumer. The plugin will check for valid signature in the `Proxy-Authorization` and `Authorization` header (in this order). This plugin implimentation follows [the draft-cavage-http-signatures-00](https://tools.ietf.org/html/draft-cavage-http-signatures-00) draft with slightly changed signature scheme.

----
## Signature Authentication Scheme

The client is expected to send an Authorization header with the following parameterization:
```
credentials := "hmac" params
params := keyId "," algorithm ", " headers ", " signature
keyId := "username" "=" plain-string
algorithm := "algorithm" "=" DQUOTE (hmac-sha1) DQUOTE
headers := "headers" "=" plain-string
signature := "signature" "=" plain-string
plain-string   = DQUOTE *( %x20-21 / %x23-5B / %x5D-7E ) DQUOTE
```
### Signature Parameters

 parameter| description
 --- | ---
 username | The username of the consumer
 algorithm | Digital signature algorithm used to create signature, only hmac-sha1 supported now 
 headers | List of HTTP header names, separated by a single space character, used to sign the request
 signature | `Base64` encoded digital signature generated by the client

### Signature String Construction

   In order to generate the string that is signed with a key, the client
   MUST take the values of each HTTP header specified by `headers` in<commit_msg>Update hmac-authentication.md<commit_after>---
id: page-plugin
title: Plugins - HMAC Authentication
header_title: HMAC Authentication
header_icon: /assets/images/icons/plugins/hmac-authentication.png
breadcrumbs:
  Plugins: /plugins
nav:
  - label: Getting Started
    items:
      - label: Installation
      - label: Configuration
  - label: Usage
    items:
      - label: Create a Consumer
      - label: Create a Credential
      - label: Upstream Headers
---

Add HMAC Signature Authentication to your APIs to establish the identity of the consumer. The plugin will check for valid signature in the `Proxy-Authorization` and `Authorization` header (in this order). This plugin implementation follows [the draft-cavage-http-signatures-00](https://tools.ietf.org/html/draft-cavage-http-signatures-00) draft with slightly changed signature scheme.

----
## Signature Authentication Scheme

The client is expected to send an Authorization header with the following parameterization:
```
credentials := "hmac" params
params := keyId "," algorithm ", " headers ", " signature
keyId := "username" "=" plain-string
algorithm := "algorithm" "=" DQUOTE (hmac-sha1) DQUOTE
headers := "headers" "=" plain-string
signature := "signature" "=" plain-string
plain-string   = DQUOTE *( %x20-21 / %x23-5B / %x5D-7E ) DQUOTE
```
### Signature Parameters

 parameter| description
 --- | ---
 username | The username of the consumer
 algorithm | Digital signature algorithm used to create signature, only hmac-sha1 supported now 
 headers | List of HTTP header names, separated by a single space character, used to sign the request
 signature | `Base64` encoded digital signature generated by the client

### Signature String Construction

   In order to generate the string that is signed with a key, the client
   MUST take the values of each HTTP header specified by `headers` in
{'fraction_non_alphanumeric': 0.09359870898332437, 'fraction_numerical': 0.00914470145239376, 'mean_word_length': 4.012129380053908, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4420570', 'n_tokens_mistral': 1022, 'n_tokens_neox': 975, 'n_words': 402}