What is HMAC Signature?
An HMAC signature is a cryptographic stamp proving that a piece of data is genuine and unaltered. It is computed by combining the data with a secret key through a hash function; anyone holding the same secret can recompute the stamp and check it matches, but nobody without the secret can forge a valid one. Change even one character of the data and the signature breaks.
In ticketing, HMAC is what makes a QR pass unforgeable: the pass ID is signed with the organiser's secret key, so a scammer who generates lookalike codes fails validation instantly โ the numbers may look right, but the signature cannot be faked. The same mechanism secures payment webhooks: Razorpay signs each notification so a merchant's server can verify the "payment received" call genuinely came from Razorpay.