Headers

Signing adds these to the request. Everything except Authorization is metadata the verifier needs in order to rebuild the signing content.

GET /orders HTTP/1.1
Host: api.example.com
Authorization: Hmac k3F9v0mQ8s2bQ1n0Xc7yA5tR6uW4pL8jH2gK1dS0fE=
Hmac-Policy: PaymentsApi
Hmac-Nonce: 6f9619ff-8b86-d011-b42d-00c04fc964ff
Hmac-DateRequested: 1723651200000

Note that the nonce and the timestamp are sent in the clear and covered by the signature. They are not secrets — they are there so the verifier can reproduce the content, and signing them is what stops anyone editing them.

Hmac-Nonce is accepted in either case, and is lowercased before it goes into the signing content — so a signer emitting an uppercase GUID is verified the same by both implementations rather than by only one.

The names are constants, not strings to retype:

HmacAuthenticationDefaults.AuthenticationScheme        // "Hmac"
HmacAuthenticationDefaults.Headers.Policy              // "Hmac-Policy"
HmacAuthenticationDefaults.Headers.DateRequested       // "Hmac-DateRequested"

import { HmacAuthenticationDefaults } from "hmac-manager";
HmacAuthenticationDefaults.Headers.Policy;             // "Hmac-Policy"

Consolidated headers

The four Hmac-* headers can be collapsed into one, Hmac-Options, whose value is a base64-encoded concatenation of the same fields.

builder.Services.AddHmacManager(options =>
{
    options.EnableConsolidatedHeaders();
});

Useful where a proxy strips unknown headers, or where a header budget is tight — four custom headers become one.

The TypeScript client takes it as the second constructor argument:

const factory = new HmacManagerFactory(policies, true);

See the header reference for the exact values.