Should I use HS256 and ES256 for authentication? – callstats.io

HS256 is symmetric algorithm where the shared secret key is stored within callstats.io dashboard and the client. ES256 is an asymmetric algorithm where you upload your public key to callstats.io dasboard and authenticate your messages using your private key. We strongly recommend you to use ES256 as it is more robust.

You can generate a new shared secret by following these steps (HS256):

Go to "My apps", click on "Settings" of the AppID and navigate to the Security tab.

You should click on "New credentials" and enter the details

1) Label : Name of the key

2) Endpoint type: Application or Middlebox (Choose Middlebox if you are creating this key for your bridge)

3) Key type : Shared secret

Click on "Create credential" and the view option would show you the shared secret,

You can upload a new public key by following these steps (ES256):

Go to "My apps", click on "Settings" of the AppID and navigate to the Security tab.

You should click on "New credentials" and enter the details

1) Label : Name of the key

2) Endpoint type: Application or Middlebox (Choose Middlebox if you are creating this key for your bridge)

3) Key type : ECDSA public key

For example

-----BEGIN PUBLIC KEY-----
MFYwEABHKoZIzj0CAQYFK4EEAAoDQgAEWp9wd4EuLhIZNaoUgZxQztSjrbqgTT0w
LBq8RwigNE6nOOXFEoGCjGfekugjrHWHUi8ms7bcfrowpaJKqMfZXg==
-----END PUBLIC KEY-----

Click on "Create credential" and the view option would show you the public key.

Related articles