topic Re: DUO AUTH API HMAC signature in APIs

DUO AUTH API HMAC signature

er-praveen1 — Wed, 24 Sep 2025 05:35:34 GMT

Hi all,

As per the DUO AUTH API documentation,

Lastly, compute the HMAC-SHA1 of this canonical representation, using your Duo application's secret key as the HMAC key. Send this signature as hexadecimal ASCII (i.e. not raw binary data). Use HTTP Basic authentication for the request, using your integration key as the username and the HMAC-SHA1 signature as the password.

Does this mean any caller is bound by these algorithms? Can I use a stronger algorithm say HMAC-SHA256 or 512?

Re: DUO AUTH API HMAC signature

DuoKristina — Thu, 25 Sep 2025 16:22:53 GMT

Hey, we have a newer signing method using SHA-512 that is not in that document, but is supported by all our API clients on GitHub. You can see those signing details here: https://github.com/duosecurity/duo_hmac_python/blob/main/duo_hmac/duo_hmac.py.

Re: DUO AUTH API HMAC signature

er-praveen1 — Fri, 26 Sep 2025 12:45:54 GMT

Thanks for the information.