topic Re: Generate Hmac token using secret key in Product Forum

Generate Hmac token using secret key

KimDougan — Fri, 14 Jan 2022 18:17:40 GMT

Hi. I need to create a hmac token using a secret key. I would really appreciate if someone could please provide the code. Many thanks!

Re: Generate Hmac token using secret key

ewilson — Fri, 14 Jan 2022 20:48:29 GMT

@Kim Dougan,

You're going to have to provide a bit more information. You say a "hmac token". Do you mean an "HMAC signature"? Is this something you need to apply to a web request? Do you know what type of HMAC? Are we talking HMAC-256, HMAC-MD5, etc.

You can find more details about the HMAC capability of .NET here. Ultimately, this is what would be used within a Code stage or Global Code page to generate your HMAC signature.

Cheers,
Eric

Re: Generate Hmac token using secret key

KimDougan — Fri, 14 Jan 2022 23:22:48 GMT

@ewilson

Thank you for replying.

Yes - it is a HMAC signature using SHA 256. It will be used for an api call between my company and a third party.

many thanks
Kim

Re: Generate Hmac token using secret key

ewilson — Sat, 15 Jan 2022 00:11:33 GMT

@Kim Dougan,

Without knowing the 3rd party platform and it's expectations for the content of the message, the best I can offer are some examples.

This is probably the most basic example of computing an HMAC256 hash for a signature:

private string GetHMAC(string text, string key)
{
  key = key ?? "";

  using (var hmacsha256 = new HMACSHA256(Encoding.UTF8.GetBytes(key)))
  {
    var hash = hmacsha256.ComputeHash(Encoding.UTF8.GetBytes(text));
    return Convert.ToBase64String(hash);
  }
}

You'll need to add a reference to the assembly mscorlib.dll and the namespace System.Security.Cryptography in your Code Options.

If you grab a copy of the Blue Prism AWS REST Utility VBO from the Digital Exchange, there's a more complex example of how to calculate an HMAC256 signature for requests to AWS services. This is an example where the platform (AWS in this case) has specific expectations regarding the various bits of data that should be included in the signature.

There are some additional examples on this Stack Overflow thread.

Cheers,
Eric

Re: Generate Hmac token using secret key

ManishRaw — Wed, 03 Aug 2022 12:43:28 GMT

Hi @ewilson,

I am trying also trying to create the HAMC-256 signature with the below requirement from the https://jwt.io :

Please not that the "secret base64 encoded" checkbox is checked.

Any idea/code like below in how I can achieve that?

I have the header, payload and encryption key details with me.

Re: Generate Hmac token using secret key

ewilson — Wed, 03 Aug 2022 15:23:02 GMT

Hi @Manish Rawat,

In my experience, if you're trying to create something similar to jwt.io then you're looking at create a JWT (Json Web Token). The best way to do that, is to use an existing library. The one I've used in the past is JWT.Net along with BouncyCastle.

Take a look at this thread and you should see some example code I posted towards the end of the thread.

Cheers,
Eric