Generate and verify MACs

A message authentication code (MAC) shows that data hasn’t changed since the MAC was generated, and that whoever generated it had access to the key. To generate a MAC, send your data to Infisical with a Generate/Verify MAC key. To check the data later, send the data and the MAC back with the same key. The key’s algorithm, such as HMAC-SHA-256, decides the MAC algorithm, so you don’t pick one for each request.

Prerequisites

A Generate/Verify MAC key
The Member role to follow the UI steps, or the Cryptographic Operator role to follow the API steps (see Who can use a key)

Generate a MAC

Infisical UI
API

In your KMS project, go to Overview, select the options menu on the key’s row, then select Generate MAC.

Enter your data in Data to Authenticate. If your data is already Base64 encoded, turn on Data is Base64 encoded.

Select Generate MAC, then copy the MAC from Message Authentication Code.

Base64 encode your data, then call the generate MAC endpoint with the key’s ID:

curl --request POST \
  --url https://app.infisical.com/api/v1/kms/keys/<key-id>/generate-mac \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "data": "SGVsbG8sIFdvcmxkIQ=="
  }'

If you use EU Cloud or self-host Infisical, replace https://app.infisical.com with https://eu.infisical.com or the address of your instance.

The response contains the Base64-encoded MAC:

{
  "mac": "<base64-encoded-mac>",
  "keyId": "<key-id>",
  "macAlgorithm": "HMAC_SHA_256"
}

Verify a MAC

Infisical UI
API

In your KMS project, go to Overview, select the options menu on the row of the key that generated the MAC, then select Verify MAC.

Enter the data in Data to Verify and the MAC in Message Authentication Code. If your data is already Base64 encoded, turn on Data is Base64 encoded.

Select Verify MAC. MAC Status shows Valid if the MAC matches the data, and Invalid if it doesn’t.

Call the verify MAC endpoint with the ID of the key that generated the MAC:

curl --request POST \
  --url https://app.infisical.com/api/v1/kms/keys/<key-id>/verify-mac \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "data": "SGVsbG8sIFdvcmxkIQ==",
    "mac": "<base64-encoded-mac>"
  }'

If you use EU Cloud or self-host Infisical, replace https://app.infisical.com with https://eu.infisical.com or the address of your instance.

In the response, macValid is true if the MAC matches the data:

{
  "macValid": true,
  "keyId": "<key-id>",
  "macAlgorithm": "HMAC_SHA_256"
}

Key management

KMIP

Integrations

Generate and verify MACs

Prerequisites

Generate a MAC

Verify a MAC

​Prerequisites

​Generate a MAC

​Verify a MAC

Prerequisites

Generate a MAC

Verify a MAC