title: C# Checking HMAC SHA256 from API
body: <p>I'm trying to validate a hmac sha256 key that an API sends to me in a header. I don't fully understand how to validate this, can anoyone point me in the right direction?</p>
  <p>From the API reference:</p>
  <blockquote>
  <p>Every central webhook POST contains a header field
  &quot;X-Signature-SHA256&quot; with the signature value of the signed body's
  payload. The JSON body is signed with the HMAC SHA256 algorithm based
  on RFC2104, with the &quot;Client Secret&quot; as the signing key.</p>
  </blockquote>
  <p>The following awnser is pretty clear &amp; helpfull:
  <a href="https://stackoverflow.com/a/12253723/4179234">https://stackoverflow.com/a/12253723/4179234</a></p>
  <p>However I feel like I'm missing a string/message that I need to encrypt to get the same hmac sha256 key, as I only have the api client secret to use as a key for the hasing but no message.</p>
  <p>Following part is taken from the above stackoverlow awnser, so I convert the api client secret to byte[] and use it for the first input var. But what should message be then in this case?</p>
  <pre><code>   private static byte[] HashHMAC(byte[] key, byte[] message)
          {
              var hash = new HMACSHA256(key);
              return hash.ComputeHash(message);
          }
  </code></pre>