# FastX402 Lab HMAC Sign & Verify

> FastX402 Lab HMAC Sign & Verify is a paid API for AI agents from fastx402.tools, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-17).

Computes HMAC-SHA256 or HMAC-SHA512 of a message with a secret key, and optionally verifies it against a provided signature

## Facts

- Endpoint: GET https://fastx402.tools/hmac-sign?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fastx402-lab-hmac-sign-verify-9bd8664e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6ieYWuk22EpwYo_c0_w1q

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fastx402-lab-hmac-sign-verify-9bd8664e
```

Example prompt: Compute the HMAC-SHA256 of this payload 'v0:1234567890:eyJldmVudCI6Im1lc3NhZ2UifQ==' using the secret 'mysecretkey' and check whether it matches the signature 'sha256=b85236760a6447cd065efe2b7bd10554c3744eff60cc53dfa47a639c5fd1e22c'.

## When to prefer this

Choose this endpoint when you need a quick, stateless HMAC computation or webhook signature verification without setting up local crypto libraries. Especially useful for verifying Stripe, GitHub, or Shopify webhooks in an agentic pipeline where inputs are not stored and pay-per-call cost is acceptable.

## Known failure modes

- Missing required 'message' or 'secret' query parameters returns an error
- Invalid algorithm value (not sha256 or sha512) may return an error or default to sha256
- Malformed signature format may cause 'matches' to return null rather than true/false
- Empty message or secret strings may produce unexpected HMAC values

## How this service works

146 pay-per-call tools for AI agents, from $0.001 per request in USDC on Base or Solana with x402. No account, no API key.

## Output

Returns a JSON object containing the HMAC digest in both hex and base64 formats, the algorithm used (sha256 or sha512), and a 'matches' field (true/false/null) indicating whether the optional provided signature matched the computed HMAC.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "message",
      "secret"
     ],
     "properties": {
      "secret": {
       "type": "string",
       "description": "The shared secret"
      },
      "message": {
       "type": "string",
       "description": "The signed payload, exactly as received"
      },
      "algorithm": {
       "enum": [
        "sha256",
        "sha512"
       ],
       "type": "string",
       "description": "sha256 or sha512 (default sha256)"
      },
      "signature": {
       "type": "string",
       "description": "Optional signature to check (hex, base64, or 'sha256=<hex>')"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "hex": {
       "type": "string"
      },
      "base64": {
       "type": "string"
      },
      "matches": {
       "type": "null"
      },
      "algorithm": {
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "hex": "b85236760a6447cd065efe2b7bd10554c3744eff60cc53dfa47a639c5fd1e22c",
  "base64": "uFI2dgpkR80GXv4re9EFVMN0Tv9gzFPfpHpjnF/R4iw=",
  "matches": null,
  "algorithm": "sha256"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fastx402-lab-hmac-sign-verify-9bd8664e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from fastx402.tools](https://www.zero.xyz/host/fastx402.tools/llms.txt)