HMAC signing

HMAC credentials sign outbound tool requests so your API can verify they originated from Chatevo. Use when your backend expects a shared-secret signature over method, path, body, or timestamp.

Create

1. Credentials → Create → HMAC.
2. Name — e.g. Inventory API signed.
3. Secret key — shared with your API verification logic.
4. Configure algorithm and header names per your API contract (e.g. SHA-256, X-Signature, X-Timestamp).
5. Save and attach to API Request tools.

Typical signed request

Your API may expect:

Element	Purpose
Canonical string	METHOD + path + timestamp + body hash
HMAC	Computed with shared secret
Headers	Signature and timestamp sent on each call

Match your server’s verification docs exactly — header names and payload order matter.

Tool vs webhook HMAC

HMAC credential	Webhook HMAC
Signs outbound tool calls to your API	Signs inbound events from Chatevo to your webhook URL
Attached to tools	Configured under Outbound webhooks

See Webhook HMAC signatures for inbound event verification.

Troubleshooting

Issue	Check
401/403 signature invalid	Clock skew on timestamp; body serialization
Intermittent failures	Encoding (UTF-8) and newline handling in canonical string

Related

• Credentials overview
• Headers and authentication
• Custom REST APIs