Hmac

An HMAC-SHA-256 tag, such as a webhook's signature.

Use it to check that a webhook came from who it says. crypto.hmac(body, key: key) gives the bytes, with a key from your settings, and Hmac(...) holds them. For a digest with no key, use Hash.

Shape

One value, held as bytes, with no parts. As text it reads W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM=.

Example

type NotASignature = Failure {    kind: FailureKind.invalid_value    message: "That isn't a signature."}var example: Hmac = attempt text.parse(    "sDRMYdjbOFNcqK/OrwvxK4gdwgDJgz2nJuk3bC4yz/c=",    as: Hmac) {    malformed: NotASignature}assert example == example

Hmac(bytes) checks them, and bytes that aren't one break the format rule.

text.parse(raw, as: Hmac) reads one from text that comes from outside. Text that isn't one at all fails malformed.

Good to know

• == on two of them takes the same time wherever they differ, so it leaks nothing.
• == tells you whether two are the same. < and list.sort_by don't take it.

In JSON

A string, in a request, a response or json.write:

"sDRMYdjbOFNcqK/OrwvxK4gdwgDJgz2nJuk3bC4yz/c=""W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM="

Details