> For the complete documentation index, see [llms.txt](https://docs.cryptobox.ninja/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cryptobox.ninja/security/enable-update-hmac.md).

# Enable/Update HMAC

{% hint style="danger" %}
This endpoint should not be consumed before every request that needs HMAC security. It should be consumed when there is no active traffic between us and the site. Failure to do this may create a race condition on active requests that require HMAC security, and these requests may result in an HMAC **errorHmacDoesNotMatch** error.
{% endhint %}

## Enabling / Updating HMAC Security API Endpoint

<mark style="color:orange;">`PUT`</mark> `https://api-prod.alfa-instap-cpt.uk/secpub/hmac`

This operation enables or updates HMAC security for the customer.&#x20;

When there is no secret, this request will initialize it. Otherwise, it will update the existing HMAC secret.

#### Headers

| Name                                           | Type   | Description              |
| ---------------------------------------------- | ------ | ------------------------ |
| content-type<mark style="color:red;">\*</mark> | string | application/json         |
| x-api-key<mark style="color:red;">\*</mark>    | String | **Replace your API key** |

#### Request Body

| Name                                         | Type   | Description                                                                                       |
| -------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------- |
| hmacSecret<mark style="color:red;">\*</mark> | string | The secret MAC to sign the payloads. It is a good idea to use UUID v4 when generating a safe MAC. |

{% tabs %}
{% tab title="200 Success" %}
The system successfully saves HMAC's secret and enables HMAC for the customer.
{% endtab %}

{% tab title="400: Bad Request errorHmacSecretDoesNotComply" %}
HMAC secret must be at least 16 characters long and must be at most 64 characters.
{% endtab %}

{% tab title="403: Forbidden Forbidden" %}

```json
{ message: 'Forbidden' }
```

A firewall rule protects (IP Whitelist ) each and every one of our endpoints. You will receive this response if your endpoint is not on the white list.
{% endtab %}
{% endtabs %}

### Example

```bash
curl --request PUT \
  --url https://api-prod.alfa-instap-cpt.uk/secpub/hmac \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: YOUR-API-KEY' \
  --data '{
	"hmacSecret": "020194f9-8c09-42ed-9b8d-23fc777990fc"
    }'
```