Creating Signed API Calls in Swift: Understanding HMAC-SHA256

As a developer, you’re likely familiar with the importance of authentication and security in your APIs. One crucial aspect is generating signatures for requests to verify authenticity and prevent tampering. In this article, we’ll explore how to create signed API calls using Swift and HMAC-SHA256.

What is HMAC-SHA256?

HMAC-SHA256 (Keyed-Hash Message Authentication Code with SHA-256) is a cryptographic algorithm that combines a secret key with a message (in our case, the encoded request data) to produce a fixed-size signature. This signature can be used for authentication and verification purposes.

Creating a Signed Request in Swift

To create a signed API call, you’ll need to:

• Encode your request data: Create an encoded representation of your request data using a library like Data or a custom implementation.

• Generate a secret key: Use a secure method (e.g., using the secrets' framework) to generate a private key for signing.

Import Foundation


class EthereumAPI {

    let apiKey = "your_api_key"

    let apiSecret = "your_api_secret"


    func signedRequest(_ requestData: [String: String]) -> ([String: String], Data) {

        // Encode the request data

        guard let encodedData = try? JSONEncoder().encode(requestData) else { return [], Data() }


        // Generate a secret key using the secrets framework

        let secretKey = try! SecretKey.generate(apiKey: apiKey, apiSecret: apiSecret)


        // Create a signature based on the HMAC-SHA256 algorithm

        guard let signature = hmacSHA256(secretKey, encodedData) else { return [], Data() }


        // Return the request data and signature as an array of tuples

        return [("code": -1022), ("msg": "Signed Request"), ("signature": signature)], encodedData

    }

}

• We first encode the request data using JSONEncoder.

• We generate a secret key usingSecretKey.generate`, which is an API-issued key.

• We create a signature based on the HMAC-SHA256 algorithm, passing in the encoded request data and our secret key.

• Finally, we return the original request data with the signed signature as a tuple of tuples.

Example Usage

let api = EthereumAPI()

let requestData = ["code": -1022, "msg": "Test Request"]

let (signedRequest, signature) = try? api.signedRequest(requestData)

print("Signed Request: \(signedRequest)")

This will output the original request data with a signed HMAC-SHA256 signature.