> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate and verify MACs

> Use message authentication codes to check that data hasn't changed.

A message authentication code (MAC) shows that data hasn't changed since the MAC was generated, and that whoever generated it had access to the key. To generate a MAC, send your data to Infisical with a Generate/Verify MAC key. To check the data later, send the data and the MAC back with the same key.

The key's algorithm, such as HMAC-SHA-256, decides the MAC algorithm, so you don't pick one for each request.

## Prerequisites

* A [Generate/Verify MAC key](https://infisical.com/docs/documentation/platform/kms/keys.md#create-a-key)
* The **Member** role to follow the UI steps, or the **Cryptographic Operator** role to follow the API steps (see [Who can use a key](https://infisical.com/docs/documentation/platform/kms/keys.md#who-can-use-a-key))

## Generate a MAC

> [tab] Infisical UI
>
> **Step 1**
>
> In your KMS project, go to **Overview**, select the options menu on the key's row, then select **Generate MAC**.
>
> **Step 2**
>
> Enter your data in **Data to Authenticate**. If your data is already Base64 encoded, turn on **Data is Base64 encoded**.
>
> **Step 3**
>
> Select **Generate MAC**, then copy the MAC from **Message Authentication Code**.

> [tab] API
>
> Base64 encode your data, then call [the generate MAC endpoint](https://infisical.com/docs/api-reference/endpoints/kms/mac/generate-mac.md) with the key's ID:
>
> ```bash theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/kms/keys/<key-id>/generate-mac \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "data": "SGVsbG8sIFdvcmxkIQ=="
>   }'
> ```
>
> > [!NOTE]
> >
> > If you use EU Cloud or self-host Infisical, replace `https://app.infisical.com` with `https://eu.infisical.com` or the address of your instance.
>
> The response contains the Base64-encoded MAC:
>
> ```json theme={"dark"}
> {
>   "mac": "<base64-encoded-mac>",
>   "keyId": "<key-id>",
>   "macAlgorithm": "HMAC_SHA_256"
> }
> ```

## Verify a MAC

> [tab] Infisical UI
>
> **Step 1**
>
> In your KMS project, go to **Overview**, select the options menu on the row of the key that generated the MAC, then select **Verify MAC**.
>
> **Step 2**
>
> Enter the data in **Data to Verify** and the MAC in **Message Authentication Code**. If your data is already Base64 encoded, turn on **Data is Base64 encoded**.
>
> **Step 3**
>
> Select **Verify MAC**. **MAC Status** shows **Valid** if the MAC matches the data, and **Invalid** if it doesn't.

> [tab] API
>
> Call [the verify MAC endpoint](https://infisical.com/docs/api-reference/endpoints/kms/mac/verify-mac.md) with the ID of the key that generated the MAC:
>
> ```bash theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/kms/keys/<key-id>/verify-mac \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "data": "SGVsbG8sIFdvcmxkIQ==",
>     "mac": "<base64-encoded-mac>"
>   }'
> ```
>
> > [!NOTE]
> >
> > If you use EU Cloud or self-host Infisical, replace `https://app.infisical.com` with `https://eu.infisical.com` or the address of your instance.
>
> In the response, `macValid` is `true` if the MAC matches the data:
>
> ```json theme={"dark"}
> {
>   "macValid": true,
>   "keyId": "<key-id>",
>   "macAlgorithm": "HMAC_SHA_256"
> }
> ```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.