How to sign and verify a message with HMAC-SHA256 in Swift

1// swift-tools-version:6.2
2import PackageDescription
3 
4let package = Package(
5    name: "howto",
6    platforms: [.macOS(.v15)],
7    dependencies: [
8        .package(url: "https://github.com/apple/swift-crypto.git", exact: "5.0.3"),
9    ],
10    targets: [
11        .executableTarget(name: "webhook", dependencies: [.product(name: "Crypto", package: "swift-crypto")]),
12    ]
13)
14 

1import Crypto // CryptoKit's API, also on Linux
2import Foundation
3 
4/// Sender: HMAC-SHA256 over the exact body bytes, sent as "sha256=<hex>".
5func sign(secret: SymmetricKey, rawBody: Data) -> String {
6    let mac = HMAC<SHA256>.authenticationCode(for: rawBody, using: secret)
7    return "sha256=" + mac.map { String(format: "%02x", $0) }.joined()
8}
9 
10/// Receiver: recompute over the raw body; isValidAuthenticationCode compares in constant time.
11func verify(secret: SymmetricKey, rawBody: Data, header: String?) -> Bool {
12    guard let header, header.hasPrefix("sha256="), let received = Data(hex: header.dropFirst(7)) else {
13        return false // a missing or malformed header fails, it never skips the check
14    }
15    return HMAC<SHA256>.isValidAuthenticationCode(received, authenticating: rawBody, using: secret)
16}
17 
18extension Data {
19    /// The bytes of an even-length string of hex digits; nil for anything else.
20    init?<S: StringProtocol>(hex: S) {
21        guard hex.count % 2 == 0, hex.allSatisfy(\.isHexDigit) else { return nil }
22        var bytes: [UInt8] = []
23        var index = hex.startIndex
24        while index < hex.endIndex {
25            let next = hex.index(index, offsetBy: 2)
26            bytes.append(UInt8(hex[index..<next], radix: 16)!) // safe: two hex digits
27            index = next
28        }
29        self.init(bytes)
30    }
31}
32