Don’t rely solely on tokens: Build a tamper-proof and replay-proof API security system using HMAC signatures + timestamps + nonce.

Umesh Kumar Yadav

13 min read

·

4 days ago

--

Listen

Share

Press enter or click to view image in full size

A practical guide to implementing application-layer API security with Java, Spring Boot, HMAC-SHA256, Redis, and JWT.

Modern API security requires more than simply authenticating users.

Imagine you are building a payment application using Spring Boot. A client sends the following request:

POST /api/v1/transfer
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Content-Type: application/json

{
  "amount": 100,
  "to": "alice"
}

Your API validates the JWT and confirms that the user is authenticated.

But what happens if someone captures a legitimate request and sends it again?

What if someone modifies a sensitive request parameter?

What if a valid request is intercepted and replayed multiple times?

JWT authentication alone does not solve all these problems.

To build a stronger API security architecture, we need three complementary mechanisms:

1. JWT — Authentication: Who is making the request?
2. HMAC Signature — Integrity: Has the request been modified?