skills.rest
api7
api7OFFICIAL
Explore all skills by this author →
Website𝕏@API7aiGitHub

a6-plugin-hmac-auth

Configure APISIX hmac-auth plugin via a6 CLI for routes and consumers.

1|2|Updated Mar 6, 2026
Search Tags:#security#authentication#plugins#apisix#consumers#hmac-auth#a6-cli
One-click install
npx skills add https://github.com/api7/a6 --skill a6-plugin-hmac-auth-api7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: a6-plugin-hmac-auth
Source: https://github.com/api7/a6/tree/main/skills/a6-plugin-hmac-auth
Command: npx skills add https://github.com/api7/a6 --skill a6-plugin-hmac-auth-api7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Configures the APISIX hmac-auth plugin securely through the a6 CLI, enabling robust request authentication for APIs.

Core Features & Use Cases

  • Bind consumer credentials (key_id/secret_key) for HMAC-based authentication.
  • Enforce allowed algorithms, clock skew tolerance, and optional body validation to ensure integrity.
  • Attach plugin configurations to routes or consumers to implement end-to-end security in typical API workflows.

Quick Start

Use the a6 CLI to create a consumer, attach an hmac-auth credential, and enable the plugin on a route.

Frequently Asked Questions about a6-plugin-hmac-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure APISIX hmac-auth plugin for consumer credentials?▼

To configure the APISIX hmac-auth plugin, use the a6 CLI to create a consumer and bind key_id and secret_key credentials. You then attach the plugin configuration to the consumer to enable HMAC-based authentication.

Can I enforce clock skew tolerance and request body validation with hmac-auth?▼

Yes, hmac-auth configuration allows enforcing allowed algorithms, clock skew tolerance, and optional request body validation. This ensures request integrity and prevents replay attacks when securing API routes via the a6 CLI.

How does HMAC authentication work for APISIX routes and consumers?▼

HMAC authentication secures APISIX routes and consumers by signing request headers with a secret key. The a6 CLI attaches these configurations to specific routes or consumers, verifying the signature against bound credentials to authorize access.

What's the best way to bind HMAC credentials to an APISIX consumer?▼

The best way to bind HMAC credentials is using the a6 consumer create or update commands. This attaches the key_id and secret_key directly to the consumer profile, linking authentication credentials to the specific APISIX consumer entity.

Do I need the a6 CLI to enable hmac-auth on APISIX routes?▼

Yes, this Skill uses the a6 CLI to enable hmac-auth on APISIX routes. You use the a6 route create or update commands to attach the plugin configuration, enforcing end-to-end security workflows without manual API calls.

Why are my signed headers failing APISIX hmac-auth validation?▼

Signed headers fail hmac-auth validation due to clock skew, incorrect algorithms, or missing body validation. Use the a6 CLI to verify that allowed algorithms and clock skew tolerance match the signing client's configuration.

Related Skills

Explore More Software Engineering Skills→
moonmingmoonming
1

a6-plugin-basic-auth

Configure Apache APISIX basic-auth plugin for routes and consumers.

Community
Intermediate
moonmingmoonming
1

a6-plugin-hmac-auth

Configure and manage the Apache APISIX hmac-auth plugin for HMAC signature verification.

Community
Intermediate
api7api7
1

a6-plugin-key-auth

Configure APISIX key-auth plugin via a6 CLI for API key authentication.

Official
Advanced
api7api7
1

a6-plugin-basic-auth

Configure APISIX basic-auth on routes and consumers via a6 commands.

Official
Intermediate