# Br Hmac Signature

> Configure better-route 0.6.0 HmacSignatureMiddleware for signed server-to-server REST requests and webhooks. Use when adding X-Signature, X-Timestamp, X-Key-Id, HmacSecretProviderInterface, ArrayHmacSecretProvider, request body HMAC verification, timestamp replay window checks, multi-key rotation, or replacing unsigned public POST endpoints with shared-secret authentication. Updated 2026-05-02.

- **Type:** Skill
- **Install:** `agentstack add skill-lonsdale201-wp-agent-skills-br-hmac-signature`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Lonsdale201](https://agentstack.voostack.com/s/lonsdale201)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** https://github.com/Lonsdale201/wp-agent-skills/tree/main/better-route/br-hmac-signature

## Install

```sh
agentstack add skill-lonsdale201-wp-agent-skills-br-hmac-signature
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# better-route: HMAC request signatures

Use this for server-to-server endpoints, webhooks, and back-channel calls where a bearer user token is not the right primitive. The middleware validates headers before the handler runs.

## Pattern

```php
use BetterRoute\Middleware\Auth\ArrayHmacSecretProvider;
use BetterRoute\Middleware\Auth\HmacSignatureMiddleware;

$hmac = new HmacSignatureMiddleware(
    secrets: new ArrayHmacSecretProvider([
        'primary' => getenv('MYAPP_WEBHOOK_SECRET'),
        'next' => getenv('MYAPP_WEBHOOK_SECRET_NEXT'),
    ]),
    signatureHeader: 'X-Signature',
    timestampHeader: 'X-Timestamp',
    keyIdHeader: 'X-Key-Id',
    replayWindowSeconds: 300,
    algorithm: 'sha256'
);

$router->post('/webhooks/provider', $handler)
    ->middleware([$hmac])
    ->publicRoute();
```

## Canonical input

The signature input is:

```text
timestamp + "\n" + method + "\n" + path + "\n" + sha256(body)
```

Default headers:

- `X-Signature`
- `X-Timestamp`
- `X-Key-Id`

Accepted signature encodings:

- lowercase hex
- uppercase hex
- base64
- base64url
- the same values prefixed with `sha256=`

## Critical rules

- Unknown key ID fails closed.
- Missing signature/timestamp/key-id fails closed with `401`.
- Timestamp outside `replayWindowSeconds` fails closed.
- Signature comparison uses `Crypto::equals()`.
- Keep secrets outside code; use constants/env/options managed by the host application.
- HMAC authenticates the sender and request body. It does not make the route private at the WordPress permission layer; pair public webhook routes with `->publicRoute()` deliberately.

## Cross-references

- Use `br-network-security` if the same route also needs a CIDR allowlist.
- Use `br-routes` for `publicRoute()` vs `protectedByMiddleware()` intent.
- Use `br-error-contract` for `401 invalid_signature` and `stale_signature` handling.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** [Lonsdale201/wp-agent-skills](https://github.com/Lonsdale201/wp-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-lonsdale201-wp-agent-skills-br-hmac-signature
- Seller: https://agentstack.voostack.com/s/lonsdale201
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.