---
title: "How to: Set Up HMAC (Hashed Key) Authentication"
slug: "how-to-set-up-hmac-hashed-key-authentication"
description: "Learn to set up HMAC authentication in Unqork for secure API calls, ensuring integrity and authenticity with hashed values."
updated: 2026-01-20T18:08:53Z
published: 2026-01-20T20:38:53Z
canonical: "docs.unqork.io/how-to-set-up-hmac-hashed-key-authentication"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to: Set Up HMAC (Hashed Key) Authentication

**HMAC (Hash-based Message Authentication Code)** authentication provides an additional layer of security by requiring a hashed value to accompany an API call. Many third-party APIs require this hashed key to verify the integrity and authenticity of the request.

In Unqork, you can configure an HMAC service and a corresponding authentication module. This guide demonstrates how to use the **Create Hash of Passed String** internal API, though configuration details vary depending on which API you're communicating with.

## Preconfiguration

### Set Up the HMAC Authentication Service

Begin by setting up an HMAC service in [Services Administration](/v1/docs/services-administration).

> [!WARNING]
> You must have the public key from the party that's receiving and decrypting the files. They'll have to set up the public/private GPG keypair.

1. At the top right of the Unqork Designer Platform, click **Administration**.
2. Under Integration, select **Services Administration**.
3. Click **+ Add a Service**.
4. In the **Service Title******* field, enter a title for your service. For example, `HMAC Authentication`.
5. In the **Service Name******* field, enter a name for your service. For example, `hmac-authentication`.

> [!TIP]
> The Service Name value is final once created. You can update the Service Title value anytime.
6. In the **Service Protocol + Host*** field, enter a temporary value. You’ll delete this value in a later step.
7. Click **Next**.
8. In the **Share To******* field, specify which workspaces to make this service available.
9. Click **Create**. The Service page displays.
10. From the menu to the left, select **Service-Type**.
11. From the **Service Type** drop-down, select **Encryption**.
12. In the **Service Protocol + Host** field, delete the temporary value.
13. Set the **Authentication Method** to **Encryption (GPG)**.
14. In the **HMAC Private Key (Armored)** field, enter the **HMAC Key**.

> [!NOTE]
> The Hash algorithm is specified when using the service.

![](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/HMAC_02_servicesadmin.jpg?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)
15. Click **Save Changes**.

After enabling the HMAC service, return to the Module Builder.

Select the tab that corresponds to your Unqork Designer experience:

**UDesigner**

### Enable Server-Side Execution Only

To improve application security, configure your HMAC module to execute on the server-side. While API modules always execute server-side, your requirements might use a **Front-End** or **Other** module type containing the [Plug-In](/v1/docs/plug-in-component) component that calls the HMAC service.

From the Module Builder page:

1. Click the ![ellipsisButtonDummy.jpg](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/ellipsisButtonDummy.jpg?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D) **(ellipsis)** button.
2. Select **Module Settings**. The Settings modal displays.
3. To the left of the modal, click **Module Settings**.
4. Set **Server Side Execution Only** to ![A toggle switch icon indicating an on state for user interface settings.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/toggledOn.jpg?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D) **(ON)**.

![Settings menu showing options for module execution and user permissions configuration.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/gpgSSE.webp?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)
5. Click **Save & Close**.

## Configure the Authentication Module

Now you're ready to set up the module that creates the hashed value.

### Configure the Hidden Components

Configure two [Hidden](/v1/docs/hidden-component) components. The first Hidden component stores the value to pass during the **Create Hash of Passed String API** call. The second component stores the returned hashed value.

1. In the Module Builder, drag and drop two **Hidden** components onto the canvas.
2. In the **Property ID** and **Label Text** fields, enter the following for each component:

| # | Property ID | Label Text |
| --- | --- | --- |
| 1 | valueToPass | valueToPass |
| 2 | hashedValue | hashedValue |
3. Click **Save Component** for each component as you add and complete its configuration.

> [!NOTE]
> You'll notice this configuration does not include defining or passing a value to the `valueToPass` **Hidden** component. The value varies based on the API's requirements. Here, the `valueToPass` **Hidden** component acts as a placeholder. When applying these steps to your use case, remember to pass or define the string you want to use in the **Create Hash of Passed String API** call.

### Configure the Initializer Component

Set up an [Initializer](/v1/docs/initializer-component) component to trigger the [Plug-In](/v1/docs/plug-in-component) component you'll create next.

1. Drag and drop an **Initializer** component onto your canvas, placing it above your Hidden components.
2. In the **Property ID** and **Canvas Label Text** fields, enter `initPluginCreateHash`.
3. From the **Trigger Type** drop-down, select **New Submission**.
4. In the **Outputs** table, enter the following:

| # | Property ID | Type | Value |
| --- | --- | --- | --- |
| 1 | pluginCreateHash | trigger | GO |

![Actions section showing trigger type and input/output fields for a submission process.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/initPluginCreateHash.webp?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)
5. Click **Save Component** after adding each component.

### Configure the Plug-In Component

Configure a [Plug-In](/v1/docs/plug-in-component) component to generate the hashed value using the **Create Hash of Passed String** internal service. To configure the **Inputs** table, use the parameters described below:

- `string`: The **Property ID** of the component containing the string you want to hash. For example, `valueToPass`.
- `algo`: The hash function required by the HMAC authentication. Supported algorithms include **SHA-256** and **SHA-512**. If left blank, it defaults to **SHA-256**.
- `encoding`: The encoding type for the returned hashed value. Supported values are **Base64** or **Hex**. If left blank, it defaults to **Hex**.
- `hmacServiceName`: The **Service Name** of your HMAC authentication service.

> [!TIP]
> You can test the **Create Hash of Passed String** endpoint using the Unqork Services page. To access the Unqork Services page, enter the following address into your browser: `https://{environment}.unqork.io/fbu/uapi/docs/documentation/#/Encryption/hashString`. Replace `{environment}` with the name of your Unqork environment.

1. Drag and drop a **Plug-In** component onto the canvas, placing it below the `valueToPass` **Hidden** component.
2. In the **Property ID** and **Canvas Label Text** fields, enter `pluginCreateHash`.
3. From the **Internal Services** drop-down, select **Create Hash of Passed String**.
4. In the **Inputs** table, enter the following:

| # | Property ID | Mapping |
| --- | --- | --- |
| 1 | valueToPass | string |
| 2 | 'sha256' | algo |
| 3 | 'base64' | encoding |
| 4 | 'HMAC-authentication' | {{hmacServiceName}} |

> [!NOTE]
> Ensure you use the hash function type, encoding type, and Service Name appropriate to your use case. For example, replace `{{hmacServiceName}}` with the name of the service created during the **Set Up the HMAC Authentication Service** step.

> [!TIP]
> Always add single quotes around values in the Property ID column that are not actually Property IDs. For example, `valueToPass` is the Property ID of your Hidden component. So, it does not need single quotes. HMAC-authentication, though, is not a Property ID in the module. So, it requires single quotes.
5. In the **Outputs** table, enter the following:

| # | Property ID | Mapping |
| --- | --- | --- |
| 1 | hashedValue | hashed |

![Inputs and outputs for the pluginCreateHash configuration in a user interface.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/pluginCreateHashUD.webp?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)
6. Click **Save Component**.

Here's how the final configuration looks in the Module Builder:

![Interface displaying HMAC authentication functions and parameters for plugin creation.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/hmacAuthModuleBuilderUD.webp?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)

Now you have a hashed value that you can pass in an API call, stored in the `hashedValue` **Hidden** component. The details of how you'll pass that value vary based on what API you're communicating with. For example, whether the value should be part of an API Request Header or not, and even what the mapping should be. You can check the API's documentation for more details.

**Classic Designer**

### Enable Server-Side Execution Only

To improve application security, configure your HMAC module to execute on the server-side. While API modules always execute server-side, your requirements might use a **Front-End** or **Other** module type containing the [Plug-In](/v1/docs/plug-in-component) component that calls the HMAC service.

From the Module Builder page:

1. On the Module Builder header, click the ![ellipsisButtonDummy.jpg](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/ellipsisButtonDummy.jpg?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D) **(ellipsis)** button.
2. Select **Settings**. The Settings modal displays.
3. Navigate to the **Module Settings** tab.
4. Set **Server Side Execution Only** to ![A toggle switch icon indicating an on state for user interface settings.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/toggledOn.jpg?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D) **(ON)**.

![Module settings for server-side execution with various options highlighted for user selection.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/gpgSSEClassic.webp?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)
5. Click **Save**.

## Configure the Authentication Module

Now you're ready to set up the module that creates the hashed value.

### Configure the Hidden Components

Configure two [Hidden](/v1/docs/hidden-component) components. The first Hidden component stores the value to pass during the **Create Hash of Passed String API** call. The second component stores the returned hashed value.

1. In the Module Builder, drag and drop two **Hidden** components onto the canvas.
2. In the **Property ID** and **Label Text** fields, enter the following for each component:

| # | Property ID | Canvas Label Text |
| --- | --- | --- |
| 1 | valueToPass | valueToPass |
| 2 | hashedValue | hashedValue |
3. Click **Save & Close** for each component after you add it.

> [!NOTE]
> You'll notice this configuration does not include defining or passing a value to the `valueToPass` **Hidden** component. The value varies based on the API's requirements. Here, the `valueToPass` **Hidden** component acts as a placeholder. When applying these steps to your use case, remember to pass or define the string you want to use in the **Create Hash of Passed String API** call.

### Configure the Initializer Component

Set up an [Initializer](/v1/docs/initializer-component) component to trigger the [Plug-In](/v1/docs/plug-in-component) component you'll create next.

1. Drag and drop an **Initializer** component onto your canvas, placing it above your Hidden components.
2. In the **Property ID** and **Canvas Label Text** fields, enter `initPluginCreateHash`.
3. Navigate to the **Actions** settings.
4. From the **Trigger Type** drop-down, select **New Submission**.
5. In the **Outputs** table, enter the following:

| # | Property ID | Type | Value |
| --- | --- | --- | --- |
| 1 | pluginCreateHash | trigger | GO |

![Actions section showing trigger type and input/output fields for a submission process.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/initPluginCreateHash.webp?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)
6. Click **Save & Close**.

### Configure the Plug-In Component

Configure a [Plug-In](/v1/docs/plug-in-component) component to generate the hashed value using the **Create Hash of Passed String** internal service. To configure the **Inputs** table, use the parameters described below:

- `string`: The **Property ID** of the component containing the string you want to hash. For example, `valueToPass`.
- `algo`: The hash function required by the HMAC authentication. Supported algorithms include **SHA-256** and **SHA-512**. If left blank, it defaults to **SHA-256**.
- `encoding`: The encoding type for the returned hashed value. Supported values are **Base64** or **Hex**. If left blank, it defaults to **Hex**.
- `hmacServiceName`: The **Service Name** of your HMAC authentication service.

> [!TIP]
> You can test the **Create Hash of Passed String** endpoint using the Unqork Services page. To access the Unqork Services page, enter the following address into your browser: `https://{environment}.unqork.io/fbu/uapi/docs/documentation/#/Encryption/hashString`. Replace `{environment}` with the name of your Unqork environment.

1. Drag and drop a **Plug-In** component onto the canvas, placing it below the `valueToPass` Hidden component.
2. In the **Property ID** and **Canvas Label Text** fields, enter `pluginCreateHash`.
3. From the **Internal Services** drop-down, select **Create Hash of Passed String**.
4. In the **Inputs** table, enter the following:

| # | Property ID | Mapping |
| --- | --- | --- |
| 1 | valueToPass | string |
| 2 | 'sha256' | algo |
| 3 | 'base64' | encoding |
| 4 | 'HMAC-authentication' | {{hmacServiceName}} |

> [!NOTE]
> Be sure to use the hash function type, encoding type, and Service Name appropriate to your use case. For example, replace `{{hmacServiceName}}` with the name of the service created during the **Set Up the HMAC Authentication Service** step.

> [!TIP]
> Always add single quotes around values in the Property ID column that are not actually Property IDs. For example, `valueToPass` is the Property ID of your Hidden component. So, it does not need single quotes. HMAC-authentication, though, is not a Property ID in the module. So, it needs single quotes.
5. In the **Outputs** table, enter the following:

| # | Property ID | Mapping |
| --- | --- | --- |
| 1 | hashedValue | hashed |

![](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/HMAC_05_pluginCreateHash_data.jpg?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)
6. Click **Save**.

Here's how the final configuration looks in the Module Builder:![Code snippet for HMAC authentication with plugin initialization and hash creation.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/hmacAuthModuleBuilder.webp?sv=2026-02-06&spr=https&st=2026-11-06T21%3A38%3A36Z&se=2026-11-06T22%3A38%3A36Z&sr=c&sp=r&sig=ogI9gMf6fFpvoqVWBgIGj3p3zHsi0wVjDYaXeO3fRho%3D)

Now you have a hashed value that you can pass in an API call, stored in the `hashedValue` **Hidden** component. The details of how you'll pass that value vary based on what API you're communicating with. For example, whether the value should be part of an API Request Header or not, and even what the mapping should be. You can check the API's documentation for more details.

APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services.

A modal is a window that appears on top of the content you are currently viewing.

A Property ID is the unique field ID used by Unqork to track and link components in your module.

Label Text conveys what the input component is and what information it displays. Enter the purpose of the corresponding component or field.

Canvas Label Text indicates the purpose of the corresponding field or component. For non-input components, the Canvas Label Text isn't end-user facing, and only appears in the .

Base64 is an encoding and decoding technique used to convert binary data to an ASCII (American Standard for Information Interchange) text format.