HMAC Authentication Overview

Dokumen ini menjelaskan konsep autentikasi HMAC untuk integrasi antar sistem eksternal.

Apa itu HMAC?

HMAC (Hash-based Message Authentication Code) adalah mekanisme untuk memastikan:

• integritas data
• keaslian pengirim

Cara kerja ringkas

1. Client System (OLT Management) membangun canonical request.
2. Client System (OLT Management) membuat signature dari string to sign.
3. Server System (External API Server) memvalidasi timestamp dan signature.
4. Jika valid, request diproses.

Header penting

Service auth

Authorization: HMAC-SHA256 CredentialType=service, CredentialId=external-system-client, SignedHeaders=x-date;x-request-id;x-client-type, Signature=<hex>
X-Date: 2026-03-16T08:30:12.000Z
X-Request-Id: 231b0de6-5d4b-4ad9-a7c5-03c2f0cba80f
X-Client-Type: service

User auth

Authorization: HMAC-SHA256 CredentialType=user, CredentialId=admin@example.com, SignedHeaders=x-date;x-tenant-id;x-request-id;x-client-type, Signature=<hex>
X-Date: 2026-03-16T08:30:12.000Z
X-Tenant-Id: tenant-123
X-Request-Id: 0126f7aa-31bc-4c84-91ef-7b7c51f594f8
X-Client-Type: web

Catatan penting

• Gunakan format baru CredentialType + CredentialId.
• Jangan log secret key di aplikasi.
• Retry harus menggunakan X-Request-Id baru.

Next

• Getting Started
• Headers
• Signature Generation