skills.rest
moonming
moonmingCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

a6-plugin-hmac-auth

Configure and manage the Apache APISIX hmac-auth plugin for HMAC signature verification.

1|2|Updated Mar 6, 2026
Search Tags:#authentication#api security#plugin configuration#hmac#apache apisix#request signing
One-click install
npx skills add https://github.com/moonming/a6 --skill a6-plugin-hmac-auth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: a6-plugin-hmac-auth
Source: https://github.com/moonming/a6/tree/main/skills/a6-plugin-hmac-auth
Command: npx skills add https://github.com/moonming/a6 --skill a6-plugin-hmac-auth

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill simplifies the process of securing API endpoints by enabling HMAC signature authentication, ensuring request integrity and authenticating clients without exposing secrets.

Core Features & Use Cases

  • HMAC Authentication: Implement robust request signing and verification using shared secrets.
  • Consumer Credential Management: Securely bind key_id and secret_key to specific consumers.
  • Use Case: Protect sensitive API endpoints by requiring clients to sign requests with a shared secret, preventing tampering and verifying the origin of requests.

Quick Start

Enable the hmac-auth plugin on a new route that protects the /api/* path.

Frequently Asked Questions about a6-plugin-hmac-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable HMAC authentication for Apache APISIX routes?▼

To enable HMAC authentication, configure the hmac-auth plugin on an Apache APISIX route to intercept requests, verify cryptographic signatures using shared secrets, and validate client identity.

What is HMAC request signing and how does it secure API endpoints?▼

HMAC request signing secures API endpoints by using a shared secret to generate a cryptographic hash for each request. This hash verifies request integrity and authenticates clients without exposing the secret key.

How do I bind key_id and secret_key to specific consumers for API security?▼

Bind key_id and secret_key to specific consumers by configuring consumer credentials in Apache APISIX. This ensures only clients with the correct HMAC signature can access protected routes.

Can I configure clock skew tolerance for HMAC signature verification in Apache APISIX?▼

Yes, Apache APISIX hmac-auth supports configurable clock skew tolerance. This allows you to specify an acceptable time difference between the client and server to prevent replay attacks while accommodating minor timing discrepancies.

What HMAC algorithms are supported by the Apache APISIX hmac-auth plugin?▼

The Apache APISIX hmac-auth plugin supports various HMAC algorithms for request signing and verification. You can select the appropriate cryptographic hashing method to meet your API security requirements.

Why am I getting authentication failures when sending HMAC signed API requests?▼

Authentication failures for HMAC signed API requests often occur due to incorrect key_id and secret_key binding, mismatched HMAC algorithms between client and server, or exceeding the configured clock skew tolerance.

Related Skills

Explore More Software Engineering Skills→
koderoverkoderover
7

apisix

Manage Apache APISIX routes, upstreams, services, and plugins via the Admin API.

Official
Intermediate
abdullah1854abdullah1854
1

sub-agent-invocation

Route tasks to specialized sub-agents with context isolation for parallel work.

Community
Advanced
moonmingmoonming
1

a6-plugin-consumer-restriction

Configure the Apache APISIX consumer-restriction plugin for access control by specifying allowed Grantees.

Community
Intermediate
moonmingmoonming
1

a6-plugin-jwt-auth

Configure Apache APISIX jwt-auth plugin for JWT request authentication.

Community
Intermediate