# hmac

Computes an HMAC (Hash-based Message Authentication Code).

Experimental

This function is experimental. The `key` parameter currently accepts a plain string because function arguments cannot be secrets yet. We plan to change this in the future.

```tql
hmac(x:any, key:string, [algorithm=string]) -> string
```

## Description

The `hmac` function computes an HMAC for the given value `x` using the provided `key`. HMAC combines a cryptographic hash function with a secret key to produce a message authentication code, useful for verifying both data integrity and authenticity.

### `x: any`

The value to authenticate. Strings and blobs are hashed directly; other types are first converted to their string representation.

### `key: string`

The secret key for the HMAC computation. Currently a plain string; secret support is planned for the future.

### `algorithm = string (optional)`

The hash algorithm to use. Defaults to `"sha256"`.

Supported algorithms: `sha256`, `sha512`, `sha384`, `sha1`, `md5`.

## Examples

### Compute an HMAC with the default algorithm (SHA-256)

```tql
from {
  digest: hmac("The quick brown fox jumps over the lazy dog", "key"),
}
```

```tql
{
  digest: "f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8",
}
```

### Compute an HMAC with SHA-512

```tql
from {
  digest: hmac("The quick brown fox jumps over the lazy dog", "key", algorithm="sha512"),
}
```

```tql
{
  digest: "b42af09057bac1e2d41708e48a902e09b5ff7f12ab428a4fe86653c73dd248fb82f948a549f7b791a5b41915ee4d1ec3935357e4e2317250d0372afa2ebeeb3a",
}
```

### Authenticate field values in a pipeline

```tql
from {message: "login_attempt", user: "alice"}
digest = hmac(message, "my-secret-key")
```

```tql
{
  message: "login_attempt",
  user: "alice",
  digest: "a52e561875744cb115f279f496517fd63e53df997a1e3f98a70dd3d7d51748b5",
}
```

## See Also

* [`hash_sha256`](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha256.md)
* [`hash_sha512`](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha512.md)
* [`hash_sha384`](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha384.md)
* [`hash_sha1`](https://preview.docs.tenzir.com/375/375/reference/functions/hash_sha1.md)
* [`hash_md5`](https://preview.docs.tenzir.com/375/375/reference/functions/hash_md5.md)