What is HMAC and how does it work?+
HMAC combines a cryptographic hash function with a secret key to produce a message authentication code. It proves both that the message hasn't been tampered with (integrity) and that the sender knows the secret key (authentication).
How do I verify a Stripe webhook with HMAC?+
Stripe sends a Stripe-Signature header containing a timestamp and HMAC-SHA256 signature of the payload signed with your webhook secret. Recompute the HMAC locally and compare - if they match, the webhook is authentic.
What is the difference between HMAC and a simple hash?+
A plain hash of a message can be recomputed by anyone. HMAC requires knowing the secret key. Without the key, an attacker cannot forge a valid HMAC even if they know the message.
Should I use HMAC-SHA256 or HMAC-SHA512?+
HMAC-SHA256 is standard and sufficient for most applications. HMAC-SHA512 provides a larger output and is marginally faster on 64-bit CPUs, but either is secure for API signing and webhook verification.