# `Hmac`

An HMAC-SHA-256 tag, such as a webhook's signature.

Use it to check that a webhook came from who it says. `crypto.hmac(body, key: key)` gives the bytes, with a key from your settings, and `Hmac(...)` holds them. For a digest with no key, use [`Hash`](/docs/types/type-hash.md).

## Shape

One value, held as bytes, with no parts. As text it reads `W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM=`.

## Example

```jadpo
type NotASignature = Failure {
    kind: FailureKind.invalid_value
    message: "That isn't a signature."
}

var example: Hmac = attempt text.parse(
    "sDRMYdjbOFNcqK/OrwvxK4gdwgDJgz2nJuk3bC4yz/c=",
    as: Hmac
) {
    malformed: NotASignature
}
assert example == example
```

`Hmac(bytes)` checks them, and bytes that aren't one break the `format` rule.

`text.parse(raw, as: Hmac)` reads one from text that comes from outside. Text that isn't one at all fails `malformed`.

## Good to know

- `==` on two of them takes the same time wherever they differ, so it leaks nothing.
- `==` tells you whether two are the same. `<` and `list.sort_by` don't take it.

## In JSON

A string, in a request, a response or `json.write`:

```json
"sDRMYdjbOFNcqK/OrwvxK4gdwgDJgz2nJuk3bC4yz/c="
"W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM="
```

## Details

<details>
<summary>Text form, storage, how it is shown, and operations</summary>

`Hmac` is in the group Security, and has been in Jadpo since 0.1.0.

### Text form

`text.from` writes one standard text form, the same form `text.parse` reads back: `sDRMYdjbOFNcqK/OrwvxK4gdwgDJgz2nJuk3bC4yz/c=` and `W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM=`.

### How it is stored

It is stored in one column named for the field, of type `bytea`. `W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM=` is stored as `E'\\x5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843'::bytea`.

### How it is shown to people

`text.format(value, locale:)` shows it to people in their locale.

With `locale: Locale.en_gb`:

| Value | Shown |
|---|---|
| `sDRMYdjbOFNcqK/OrwvxK4gdwgDJgz2nJuk3bC4yz/c=` | `sDRMYdjbOFNcqK/OrwvxK4gdwgDJgz2nJuk3bC4yz/c=` |
| `W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM=` | `W9zBRr9gdU5qBCQmCJV1x1oAPwidJzmDnexYuWTsOEM=` |

### Operations

It also takes `text.parse`, `text.from`, `text.format`, `json.read`, `json.write` and `==`. [How every standard type behaves](/docs/every-standard-type-meets-one-contract.md) says how they work.

</details>