Secure the frontend SDK

Before moving to production, you must ensure nobody else can create a new connection.

Add a secret HMAC key (large, random value) in your Environment Settings tab in the Nango UI.

Generate the HMAC signature in your backend and pass it to your frontend before you make nango.auth calls.

The HMAC signature can be generated with the following code:

• Javascript/Typescript
• Python
• Java
• Ruby
• Go
• Rust
• PHP

import * as crypto from 'node:crypto';

// Enforce backend authentication before generating the HMAC digest.
const hmac = crypto.createHmac('sha256', '<HMAC-KEY>'); // HMAC key set in your environment settings.
hmac.update('<INTEGRATION-ID>:<CONNECTION-ID>');
const digest = hmac.digest('hex');

In the frontend, pass the HMAC signature in nango.auth() (reference):

nango.auth('<INTEGRATION-ID>', '<CONNECTION-ID>', { hmac: '<HMAC-DIGEST>' });

Enable the HMAC checkbox in the Environment Settings tab in the Nango UI.