Knowledge · Security
HMAC authentication guide: signing casino API requests the right way
Every AS Tech iGaming API request is authenticated with an HMAC-SHA256 signature — not a bearer token. This guide covers the canonical payload format, timestamp skew rules, replay protection and language-agnostic code samples.
Updated June 2026 · AS Tech iGaming editorial
Why HMAC?
Bearer tokens are trivial to leak: one screenshot of a network tab, one log line, one accidental Slack message is enough. HMAC signs the request body and timestamp, so intercepting the signature buys an attacker nothing — the signature is bound to the exact payload. Combined with a 5-minute timestamp window, replays are effectively impossible.
Canonical payload
The string you sign is concatenated in a fixed order:
<timestamp>\n<HTTP_METHOD>\n<path>\n<raw_json_body>
Where timestamp is Unix seconds, path is the URL path (no query string, no host), and raw_json_body is the exact bytes you POST — do not re-serialize, whitespace matters.
Node.js example
import crypto from "node:crypto";
const ts = Math.floor(Date.now() / 1000).toString();
const body = JSON.stringify({ player_id: "p_123", amount: 10, currency: "USD" });
const payload = `${ts}\n POST\n /api/public/v1/bet\n ${body}`;
const signature = crypto.createHmac("sha256", process.env.HMAC_SECRET)
.update(payload).digest("hex");
await fetch("https://api.astechigaming.shop/api/public/v1/bet", {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-API-Key": process.env.API_KEY,
"X-Timestamp": ts,
"X-Signature": signature,
},
body,
});PHP example
$ts = (string) time();
$body = json_encode(["player_id" => "p_123", "amount" => 10, "currency" => "USD"]);
$payload = "$ts\nPOST\n/api/public/v1/bet\n$body";
$signature = hash_hmac("sha256", $payload, getenv("HMAC_SECRET"));Server-side verification (what AS Tech does)
- Reject if
|now − timestamp|> 300 seconds. - Look up the API key, load its HMAC secret from the vault.
- Recompute the signature over the received timestamp + method + path + raw body.
- Timing-safe compare against
X-Signature. - Enforce per-key rate limits and (if configured) IP allowlist.
Common mistakes
- Re-serializing the JSON body between signing and sending — whitespace changes break the signature.
- Signing the full URL (with host and query) instead of just the path.
- Using millisecond timestamps instead of seconds.
- Storing the HMAC secret in a mobile app or browser bundle.
- Comparing signatures with
==instead of a timing-safe compare (opens up timing attacks).
Frequently asked questions
What is HMAC authentication?+
HMAC (Hash-based Message Authentication Code) is a cryptographic signature that proves a request came from a party who knows a shared secret, without ever sending the secret over the wire.
Why does AS Tech use HMAC instead of bearer tokens?+
HMAC signs the full request body and timestamp, so a leaked signature can't be replayed and a proxy that only sees headers can't forge new requests. Bearer tokens leak on a single log line.
Which algorithm does AS Tech use?+
HMAC-SHA256. The signature is a 64-character lowercase hex string sent in the X-Signature header.
What is included in the signed payload?+
The request timestamp, HTTP method, path and raw JSON body — concatenated in a fixed canonical order defined in the API docs.
How long is a signature valid for?+
Five minutes. Requests with a timestamp skew greater than ±300 seconds are rejected to prevent replay attacks.
Where do I store the HMAC secret?+
Server-side only — in your secrets manager, environment variable or vault. Never in a mobile app, browser bundle or public repository.