a6-plugin-hmac-auth

Configure APISIX hmac-auth plugin via a6 CLI for routes and consumers.

1|2|Updated Mar 6, 2026

Search Tags:#security #authentication #plugins #apisix #consumers #hmac-auth #a6-cli

Ready to run

npx skills add https://github.com/api7/a6 --skill a6-plugin-hmac-auth-api7

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: a6-plugin-hmac-auth
Source: https://github.com/api7/a6/tree/main/skills/a6-plugin-hmac-auth
Command: npx skills add https://github.com/api7/a6 --skill a6-plugin-hmac-auth-api7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Configures the APISIX hmac-auth plugin securely through the a6 CLI, enabling robust request authentication for APIs.

Core Features & Use Cases

Bind consumer credentials (key_id/secret_key) for HMAC-based authentication.
Enforce allowed algorithms, clock skew tolerance, and optional body validation to ensure integrity.
Attach plugin configurations to routes or consumers to implement end-to-end security in typical API workflows.

Quick Start

Use the a6 CLI to create a consumer, attach an hmac-auth credential, and enable the plugin on a route.

Frequently Asked Questions about a6-plugin-hmac-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure APISIX hmac-auth plugin for consumer credentials?▼

To configure the APISIX hmac-auth plugin, use the a6 CLI to create a consumer and bind key_id and secret_key credentials. You then attach the plugin configuration to the consumer to enable HMAC-based authentication.

Can I enforce clock skew tolerance and request body validation with hmac-auth?▼

Yes, hmac-auth configuration allows enforcing allowed algorithms, clock skew tolerance, and optional request body validation. This ensures request integrity and prevents replay attacks when securing API routes via the a6 CLI.

How does HMAC authentication work for APISIX routes and consumers?▼

HMAC authentication secures APISIX routes and consumers by signing request headers with a secret key. The a6 CLI attaches these configurations to specific routes or consumers, verifying the signature against bound credentials to authorize access.

What's the best way to bind HMAC credentials to an APISIX consumer?▼

The best way to bind HMAC credentials is using the a6 consumer create or update commands. This attaches the key_id and secret_key directly to the consumer profile, linking authentication credentials to the specific APISIX consumer entity.

Do I need the a6 CLI to enable hmac-auth on APISIX routes?▼

Yes, this Skill uses the a6 CLI to enable hmac-auth on APISIX routes. You use the a6 route create or update commands to attach the plugin configuration, enforcing end-to-end security workflows without manual API calls.

Why are my signed headers failing APISIX hmac-auth validation?▼

Signed headers fail hmac-auth validation due to clock skew, incorrect algorithms, or missing body validation. Use the a6 CLI to verify that allowed algorithms and clock skew tolerance match the signing client's configuration.