# Halowerk IoT Device HMAC-SHA256 Authentication

> Halowerk IoT Device HMAC-SHA256 Authentication is a paid API for AI agents from iot.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-15).

Canonicalizes device_id, nonce, and message, then computes or verifies an HMAC-SHA256 authentication tag using caller-supplied ephemeral key material for IoT device challenge-response flows.

## Facts

- Endpoint: POST https://iot.halowerk.com/v1/device-auth
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-iot-device-hmac-sha256-authentication-f9fcdaf3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_uNX8dWAwB4lAU3uAV5ksI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-iot-device-hmac-sha256-authentication-f9fcdaf3 -d '<json body>'
```

Example prompt: Compute an HMAC-SHA256 authentication tag for device 'sensor-42', using nonce 'a8f3c1d9e2b74056', message 'activate-pump-zone-3', and my ephemeral key 'ek_tmp_9x2mK7vQpRsLn4Yw'; also verify it against my claimed tag 'a3f1...c9d2' (full 64 hex chars).

## When to prefer this

Choose this endpoint when you need a stateless, server-side HMAC-SHA256 computation or constant-time tag verification for IoT device challenge-response flows without managing your own crypto library. It is best suited for ephemeral session authentication where you supply short-lived key material per session — not for long-lived production secrets, asymmetric identity, or device provisioning. Prefer this over rolling your own HMAC when you need a consistent canonicalization scheme across heterogeneous IoT devices.

## Known failure modes

- nonce shorter than 8 characters or longer than 256 characters returns a validation error
- ephemeral_key shorter than 16 characters returns a key length error
- claimed_tag_hex not exactly 64 hex characters returns a format validation error
- message exceeding 4096 characters returns a payload size error
- malformed JSON body returns a 400 parse error
- missing required fields (device_id, nonce, message, ephemeral_key) returns a 422 unprocessable entity error

## How this service works

Canonicalizes device_id, nonce and message, computes an HMAC-SHA256 tag with caller-supplied ephemeral key material, and optionally compares a claimed tag in constant time. It does not provision devices, store keys or replace asymmetric device identity; do not submit long-lived production secrets.

## Output

Returns the computed HMAC-SHA256 tag as a 64-character hex string over the canonicalized (device_id, nonce, message) tuple. If claimed_tag_hex is provided, also returns a boolean constant-time comparison result indicating whether the claimed tag matches the computed tag. Does not store keys, provision devices, or issue persistent credentials.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "nonce": {
   "type": "string",
   "maxLength": 256,
   "minLength": 8,
   "description": "Fresh caller-generated challenge nonce."
  },
  "message": {
   "type": "string",
   "maxLength": 4096,
   "minLength": 1,
   "description": "Challenge payload."
  },
  "device_id": {
   "type": "string",
   "maxLength": 128,
   "minLength": 1,
   "description": "Stable device identifier."
  },
  "ephemeral_key": {
   "type": "string",
   "maxLength": 512,
   "minLength": 16,
   "description": "Ephemeral HMAC key; long-lived production keys must not be sent."
  },
  "claimed_tag_hex": {
   "type": "string",
   "pattern": "^[0-9a-fA-F]{64}$"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-iot-device-hmac-sha256-authentication-f9fcdaf3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from iot.halowerk.com](https://www.zero.xyz/host/iot.halowerk.com/llms.txt)