HMAC Auth

Release date 2026/04/07

Feature

• Add support for HMAC-SHA224, and removes HMAC-SHA1 from the default set of algorithms (still supports HMAC-SHA1 when configured).

Release date 2025/12/18

Feature

• Enabled at-rest keyring encryption for sensitive fields in HMAC Auth plugin.

Release date 2025/03/27

Bugfix

• Improved the error message which occurred when an anonymous consumer was configured but did not exist.

Release date 2024/09/11

Bugfix

• Add WWW-Authenticate headers to 401 responses.

Release date 2022/12/06

Feature

• The anonymous field can now be configured as the username of the consumer. This field allows you to configure a string to use as an “anonymous” consumer if authentication fails.

Release date 2022/09/09

Bugfix

• Removed deprecated signature format using ngx.var.uri.#8558

Breaking Change

• Updated the priority for some plugins.: hmac-auth changed from 1000 to 1030