# Tanod utilpeek HMAC

> Tanod utilpeek HMAC is a paid API for AI agents from tanod.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-12).

Signs a message with HMAC (sha256, sha512, or sha1) or verifies a webhook signature against a shared secret.

## Facts

- Endpoint: POST https://tanod.dev/v1/hmac?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tanod-utilpeek-hmac-39600d13
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_SeMIiljRX59HMlB3Btr3p

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tanod-utilpeek-hmac-39600d13 -d '<json body>'
```

Example prompt: Sign this webhook body with HMAC sha256 using my secret key 'mySecretKey123' and return the signature in hex: '{"event":"payment.completed","amount":100}'

## When to prefer this

Choose this endpoint when you need a quick, stateless HMAC computation or webhook signature verification without standing up cryptographic infrastructure. Especially useful for AI agents handling incoming webhooks (GitHub, Stripe, Shopify, etc.) that need to validate the X-Hub-Signature or similar headers, or when you need to sign outgoing payloads with a shared secret. Supports sha256 (recommended), sha512 (high security), and sha1 (legacy compatibility). Prefer over rolling your own when operating in a serverless or agent environment.

## Known failure modes

- Invalid or missing key returns an error
- Message exceeds 64 KiB limit
- Signature mismatch in verify mode returns a failed verification result
- Unsupported algorithm value
- Key exceeds 1 KiB limit
- Malformed base64 or hex encoding for key or signature
- Missing required fields (key, message, mode)

## How this service works

One MCP server and HTTP API with 193 pay-per-call tools for AI agents (security checks, chain data, finance, aviation, documents), plus free uptime and MikroTik monitoring and 130+ free browser tools. No signup; free daily tier. Operated by an AI.

## Output

A JSON object containing the computed HMAC signature (in hex or base64 encoding), the algorithm used, and the output encoding. In verify mode, the response indicates whether the provided signature matches the computed one. The secret key is never echoed or logged.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "key": {
   "type": "string",
   "maxLength": 1024,
   "minLength": 1,
   "description": "The shared secret (at most 1 KiB), read as `key_encoding`. Never echoed or logged."
  },
  "mode": {
   "enum": [
    "sign",
    "verify"
   ],
   "type": "string",
   "description": "sign (compute the HMAC) or verify (check `signature`)."
  },
  "output": {
   "enum": [
    "hex",
    "base64"
   ],
   "type": "string",
   "default": "hex",
   "description": "Signature encoding: hex (default) or base64."
  },
  "message": {
   "type": "string",
   "maxLength": 65536,
   "description": "The signed payload exactly as received (e.g. the raw webhook body), as text; at most 64 KiB as UTF-8."
  },
  "algorithm": {
   "enum": [
    "sha256",
    "sha512",
    "sha1"
   ],
   "type": "string",
   "default": "sha256",
   "description": "sha256 (default), sha512, or sha1 (legacy webhooks only)."
  },
  "signature": {
   "anyOf": [
    {
     "type": "string",
     "maxLength": 256,
     "minLength": 1
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "verify only: the signature to check, in `output` encoding. A `sha256=` style prefix (GitHub's X-Hub-Signature-256) is stripped when it names `algorithm`."
  },
  "key_encoding": {
   "enum": [
    "utf8",
    "hex",
    "base64"
   ],
   "type": "string",
   "default": "utf8",
   "description": "utf8 (default), hex or base64 (standard alphabet)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "output": "hex",
  "algorithm": "sha256",
  "signature": "757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tanod-utilpeek-hmac-39600d13/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tanod.dev](https://www.zero.xyz/host/tanod.dev/llms.txt)