Step 1
Step 2
Step 3
Step 4
Payload
Secret Key
Signature A
H
$$\text{Sig A} = \text{HMAC}(\text{Payload}, \text{Key})$$
HTTP Header
Payload
Signature A
Payload
Secret Key
Signature B
H
$$\text{Sig B} = \text{HMAC}(\text{Payload}, \text{Key})$$
Signature A
Signature B
Authentic
$$\text{Sig A} \equiv \text{Sig B}$$