# Agent Payload Tools – HMAC Signature

> Agent Payload Tools – HMAC Signature is a paid API for AI agents from api.agent-payload-tools.workers.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Computes an HMAC digest (SHA-256/384/512) for a UTF-8 message using a caller-supplied secret, with optional constant-time verification against an expected hex digest.

## Facts

- Endpoint: POST https://api.agent-payload-tools.workers.dev/hmac
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-payload-tools-hmac-signature-0d1c2dc3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Kou-AdARgij9-FexISYwr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-payload-tools-hmac-signature-0d1c2dc3 -d '<json body>'
```

Example prompt: Compute an HMAC-SHA-256 signature for the message 'order_id=12345&amount=99.99' using the secret 'my-webhook-secret-key', and check if it matches the expected digest 'a3f1b2c4...'

## When to prefer this

Choose this endpoint when an AI agent needs a deterministic, stateless HMAC computation without managing cryptographic libraries — especially useful for webhook verification, API request signing, or integrity checks inside an automated workflow. The constant-time comparison option makes it suitable for security-sensitive verification where timing attacks are a concern. Prefer over general-purpose code execution for simplicity and auditability.

## Known failure modes

- Missing or empty secret returns a 400/422 validation error
- Invalid algorithm value (not SHA-256, SHA-384, or SHA-512) returns a validation error
- Malformed expected_hex (non-hex characters) returns a pattern validation error
- Empty input is allowed (computes HMAC of empty string) but may produce unexpected results
- Payment failure or insufficient USDC balance returns a 402 response before processing

## How this service works

Create or compare an HMAC using SHA-256, SHA-384, or SHA-512.

## Output

Returns the HMAC hex digest of the input message computed with the specified algorithm and secret. If an expected_hex was provided, also returns a boolean indicating whether the computed digest matches in constant time (resistant to timing attacks). The secret is not stored or logged.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "input": {
   "type": "string",
   "default": "",
   "description": "UTF-8 message to authenticate."
  },
  "secret": {
   "type": "string",
   "minLength": 1,
   "description": "HMAC secret for this call. It is not stored."
  },
  "algorithm": {
   "enum": [
    "SHA-256",
    "SHA-384",
    "SHA-512"
   ],
   "type": "string",
   "description": "Digest algorithm. Defaults to SHA-256."
  },
  "expected_hex": {
   "type": "string",
   "pattern": "^[0-9a-fA-F]*$",
   "description": "Optional hexadecimal digest to compare in constant time."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-payload-tools-hmac-signature-0d1c2dc3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agent-payload-tools.workers.dev](https://www.zero.xyz/host/api.agent-payload-tools.workers.dev/llms.txt)