api.auth generates hmac