---
title: HMAC Payload
slug: infra/hmac-payload
createdAt: 2021-09-03T17:52:29.000Z
---

Because Socratease is a front-end library, we need to ensure that the data that gets sent to Socratease's server **hasn't been tampered** with. For instance, imagine a user who modifies the JavaScript code and grants themselves a Super Admin role. They will then be able to take over your entire website.

To prevent this from happening, the SDK takes an extra parameter called the HMAC Payload. This should be generated by your backend. The example in the snippet shows you how you can calculate the HMAC of the payload.

The steps are:

1. Determine the [Payload](docId:_7cy1QkSWkEzcP719c1Vu) you want to send
2. Convert it to a JSON
3. Calculate the HMAC of the JSON using SHA256 and signing it with your SECRET\_KEY
4. Encode it using Base 64
5. This is the hmacPayloadBase64 parameter in the SDK

Because the payload is signed with your SECRET\_KEY in the backend, your website users will not be able to tamper with the payload.

This is why your SECRET\_KEY must be extremely confidential.