> ## Documentation Index
> Fetch the complete documentation index at: https://docs.telli.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HMAC-SHA256

> Add HMAC-SHA256 signatures to HTTP requests and verify them at your endpoint

Credentials are currently available only in workflows.

Go to **Settings → Developer → Add credential**, select **HMAC-SHA256**, and give it a name. In an **HTTP request** block, select the saved credential under **Authentication**.

Use **HMAC-SHA256** to verify requests at your endpoint. Save the generated secret securely when you create the credential; telli shows it only once.

Each request includes an `x-telli-signature` header containing the HMAC-SHA256 signature of the exact request body, encoded as hexadecimal. To verify it, use the saved secret as the key and the raw body as the message, then compare the hexadecimal result with the header using a constant-time comparison. For requests without a body, use an empty string.


## Related topics

- [Contact lookup webhook](/contact-lookup-webhook.md)
- [Workflows](/platform/workflows.md)
- [Connect your calendar](/cookbooks/calendar-integration/overview.md)