How to Create and Verify HMAC SHA256 API Signatures in Python

import hmac
import hashlib
import base64
import json
from datetime import datetime, timezone

def create_api_signature(secret_key: str, method: str, path: str, timestamp: str, body: dict = None) -> str:
    """Create HMAC-SHA256 signature for API request."""
    payload = {
        "method": method.upper(),
        "path": path,
        "timestamp": timestamp,
        "body": body or {}
    }
    message = json.dumps(payload, sort_keys=True, separators=(',', ':'))
    signature = hmac.new(
        secret_key.encode(),
        message.encode(),
        hashlib.sha256
    ).digest()
    return base64.b64encode(signature).decode()


def verify_api_signature(secret_key: str, signature: str, method: str, path: str, timestamp: str, body: dict = None) -> bool:
    """Verify an incoming API signature."""
    expected = create_api_signature(secret_key, method, path, timestamp, body)
    return hmac.compare_digest(expected, signature)


if __name__ == "__main__":
    secret = "my-secret-key-2024"
    timestamp = datetime.now(timezone.utc).isoformat()
    
    method = "POST"
    path = "/api/v1/users"
    request_body = {"name": "Alice", "role": "admin"}
    
    signature = create_api_signature(secret, method, path, timestamp, request_body)
    print(f"Generated signature: {signature}")
    
    is_valid = verify_api_signature(secret, signature, method, path, timestamp, request_body)
    print(f"Signature valid: {is_valid}")
    
    tampered_body = {"name": "Alice", "role": "user"}
    is_valid_tampered = verify_api_signature(secret, signature, method, path, timestamp, tampered_body)
    print(f"Tampered request rejected: {not is_valid_tampered}")