title: Hmac Authentication in Browsers
body: <p>I am building a rest api and i want to secure my apis and wanted to use HMAC authentication.</p>
  
  <p>My doubt is, should Hmac authentication be used only for integration with third party api's or can they securely be used in the browser also.</p>
  
  <p>If yes,
  how to securely share api secret from server to browser.
  Is it safe to directly send this secret over HTTPS?</p>
  
  <p>It would be great if someone who has experience with hmac authentication in browsers can tell some flow and advantages/disdvantages of this approach.</p>
  
  <p>Thanks</p>