---
title: "HMAC signature of a message"
method: POST
path: "/v1/tools/hmac"
---

# HMAC signature of a message

`POST /v1/tools/hmac`

## Request

- Base URL: `https://mcp.cleanor.app`
- URL: `https://mcp.cleanor.app/v1/tools/hmac`
- Auth: none declared

Compute an HMAC (keyed hash) of a message with a secret, using SHA-1/256/384/512, returned as hex or Base64. Use to sign webhook payloads or verify a signature instead of guessing. LLMs cannot compute this by hand.

## Request body

- object
  - `message` string, required: The message to sign (UTF-8).
  - `secret` string, required: The shared secret key (UTF-8).
  - `algorithm` 'sha-256' | 'sha-1' | 'sha-384' | 'sha-512': Hash algorithm.
  - `encoding` 'hex' | 'base64': Output encoding.

## Response `200`

Tool result: `data` (structured) and `text` (human-readable).

- ToolResult
  - `ok` boolean
  - `tool` string
  - `data` object, nullable
  - `text` string
  - `attribution` string

## Other responses

- `400`: Invalid arguments.
- `429`: Rate limited (120 requests per minute per IP).

---

[API](https://skmtc.dev/cleanor/apis/cleanor-api.md) · [All operations](https://skmtc.dev/cleanor/apis/cleanor-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cleanor/apis/cleanor-api/revisions/5f7be54e7a84?raw)