--- updatedAt: 2026-08-18T12:20:37.000Z --- Fetch the complete documentation index at: https://developers.deliverect.com/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version. # HMAC Authentication ## Introduction A pre-shared secret can be provided to verify API request authenticity use HMAC-SHA256 ## What is HMAC? HMAC (Hash-based Message Authentication Code) uses a cryptographic hash function (SHA256 in our case) and a pre-shared secret to generate a signature. This signature ensures the integrity and authenticity of the message payload. ## How the HMAC Signature is Generated We hash the request payload using the SHA256 algorithm to generate a hex-encoded HMAC signature. This signature is included in the request header, as shown below: You can then use a pre-shared secret as the key to verify that the request originated from us and that the payload was not altered. ```text Example HMAC Header x-server-authorization-hmac-sha256: 65060aeeee*********************eeebdad3196e9d7 ``` {` `} ## Obtaining HMAC Secret Key One HMAC secret key can be provided per environment; **Staging (Testing Environment)** Prior to being certified, we sign requests using a temporary secret value, which may be either: * `channelLink` (present in most calls to partner endpoints) * `locationId` (applicable to Dispatch API integrations and Get Products webhook for POS integrations) **Production (Live Environment)** Certified partners can generate their production HMAC secret via the Integration settings. Refer to the guide below for instructions; {` ▶ Generate HMAC Secret `} {` `}