Hashing, HMAC & Checksum Suite: POST /hash
Give this API any text or binary data and it instantly returns its fingerprint under whichever hash algorithms you choose — SHA-256, SHA-512, MD5, BLAKE2, CRC32, and more. It also signs data with a secret key (HMAC) and, most importantly, safely verifies whether an incoming signature matches — using a timing-safe comparison that prevents secret-leaking attacks. Language models cannot perform hashing: they produce a string of the right length and character set that looks correct but is simply wrong. Every webhook verification, idempotency key, cache fingerprint, or integrity check that relies on a hallucinated hash is silently broken. This API is the cure.
Start with a quote-only recipe. Payment signing stays in your project.
const response = await fetch("https://hash-hmac.underscoredone.com/hash", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
"type": "http",
"method": "POST",
"bodyType": "json",
"bodyFieldNames": [
"algorithms",
"hmac",
"input",
"input_encoding",
"output_encoding"
],
"pathParamNames": [],
"queryParamNames": []
}),
});
console.log(response.status);
console.log(Object.fromEntries(response.headers));
console.log((await response.text()).slice(0, 1000));
// A valid 402 is a quote, not a completed paid call.Review the provider input schema before running this non-read-only method. No payment code is included.
- Exact route checked
not safely testable · potentially-mutating-method:POST
- Origin reachable
HEAD https://hash-hmac.underscoredone.com/ returned 301.
- Observed in cdp-bazaar
The registry record was observed and retained with provenance.
EVIDENCE
Each record has an exact-route quote outcome. Unresolved templates and potentially mutating methods are labeled instead of being invoked without provider-specific test input. A quote is still separate from a settled paid call.