+++
title = "Using HMAC Authentication"
weight = 74
updated = 2023-06-13
aliases = ["/docs/using-hmac-authentication.html", "/docs/bonsai-api/authentication/using-hmac-authentication/"]

[extra]
nav_title = "Using HMAC Authentication"
weight = 30
+++

The Bonsai API supports a hash-based message authentication code protocol for authenticating requests.

### Alpha Stage

{% admonition(title="Info") %}
The Bonsai API is currently in its Alpha release phase. It may not be feature-complete, and is subject to change without notice. If you have any questions about the roadmap of the API, please reach out to [support](mailto:support@bonsai.io).
{% end %}

#### **HMAC**

The Bonsai API supports a [hash-based message authentication code](https://en.wikipedia.org/wiki/HMAC) protocol for authenticating requests. This scheme allows the API to simultaneously verify both the integrity and the authenticity of a user's request.

This authentication protocol requires that all API requests include three HTTP headers:

- **X-BonsaiApi-Time.** The current Unix time – seconds since epoch. This value helps to guarantee uniqueness over time, and must be within one minute of our server time to prevent replay attacks.
- **X-BonsaiApi-Key.** The API token's key, as generated within the Bonsai application. This key will also have a corresponding secret.
- **X-BonsaiApi-Hmac.** The hexadecimal HMAC-SHA1 digest of your shared secret and the concatenation of the above time and public key.

For example, in Ruby, the X-BonsaiApi-Auth header can be computed as: `OpenSSL::HMAC.hexdigest('sha1', token_secret, "#{time}#{token_key}")`, where the `token_secret` is the API key's secret.