> For the complete documentation index, see [llms.txt](https://doc.blowhorn.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.blowhorn.com/api-docs/webhook/hmac-authentication.md).

# HMAC Authentication

HMAC (hash-based message authentication code) is used to verify that a request is coming from an expected source and that the request has not been tampered with in transit. This is achieved by including both a public (key-identifier) and private key (key-secret) in each message, the latter of which is only known to the server and client.

Blowhorn webhooks pass the Business Customer API Key in the API header for use.