Hash-Based Message Authentication Code (HMAC) is a secure way to connect to the Sovos Data Center. To generate an HMAC, you will need the following:
- The secret key and access key provided by Sovos during onboarding
- The current timestamp, called the request date
Each request to the Sovos Data Center must contain a valid HMAC for secure access. Without an HMAC, Sovos' authentication layer will reject the request.
Header formats
This table shows the header formats for HTTPS requests for generating the HMAC:
Key |
Value |
| Authorization | HMAC generated using the secret key, access key, and request date |
| x-request-date |
Must be UTC combined date and time in ISO 8601 format Example: Date: December 4, 2024 Time: 11:36 AM ET (UTC-05:00) ISO format: 2024-12-04T11:36:00-05:00 |
Example script (Javascript)
The following pre-request script is one method for generating the HMAC:
const ACCESS_KEY = '<insert access key>';
const SECRET_KEY = '<insert secret key>';
var timestamp = new Date().toISOString();
function getAuthHeader(secretKey, data) {
var hmacDigest = determineAuthDigest(data, secretKey);
var authHeader = ACCESS_KEY + ':' + hmacDigest;
return authHeader; }
function determineAuthDigest(data, secretKey) {
return CryptoJS.HmacSHA256(data, secretKey).toString(CryptoJS.enc.Base64); }
var authHeader = getAuthHeader(SECRET_KEY, timestamp + ACCESS_KEY);