a6-plugin-hmac-auth

Overview

The hmac-auth plugin authenticates requests using HMAC (Hash-based Message Authentication Code) signatures. Clients compute an HMAC signature over the request method, path, date, and optional headers/body, then include it in the Authorization header. APISIX recomputes the signature server-side and verifies it matches. This provides request integrity verification without transmitting secrets over the wire.

When to Use

• Request integrity verification (tamper-proof API calls)
• Server-to-server authentication where both sides share a secret
• APIs requiring body integrity validation
• Environments where tokens or passwords should never appear in requests

Plugin Configuration Reference (Route/Service)