juspay/hyperswitch · error · Error

computeHmac: 'key' and 'message' are required (got key=${!!k

Error message

computeHmac: 'key' and 'message' are required (got key=${!!key}, message=${!!message})

What it means

Thrown by the computeHmac Cypress task in cypress-tests/cypress.config.js when either key or message is falsy. The task wraps node crypto.createHmac (default sha512) to compute the HMAC signature header tests attach to requests (e.g. checkout/webhook signing); the guard rejects empty secrets or payloads before crypto gets garbage.

Source

Thrown at cypress-tests/cypress.config.js:68

        },
        readFileOrNull: (filePath) => {
          if (!fs.existsSync(filePath)) return null;
          try {
            return JSON.parse(fs.readFileSync(filePath, "utf8"));
          } catch {
            return null;
          }
        },
        cli_log: (message) => {
          // eslint-disable-next-line no-console
          console.log("Logging console message from task");
          // eslint-disable-next-line no-console
          console.log(message);
          return null;
        },
        computeHmac: ({ key, message, algorithm = "sha512" }) => {
          if (!key || !message) {
            throw new Error(
              `computeHmac: 'key' and 'message' are required (got key=${!!key}, message=${!!message})`
            );
          }
          const signature = crypto
            .createHmac(algorithm, key)
            .update(message)
            .digest("hex");
          return signature;
        },
      });
      on("after:spec", (spec, results) => {
        // Clean up resources after each spec
        if (
          results &&
          results.video &&
          !results.tests.some((test) =>
            test.attempts.some((attempt) => attempt.state === "failed")
          )

View on GitHub (pinned to 9b8b89dc37)

Solutions

Set the HMAC key env var for the run (e.g. CYPRESS_HMAC_KEY or however the spec sources it) so key is non-empty
Ensure message is the serialized request body string — JSON.stringify it at the call site if needed
Search failing specs for cy.task('computeHmac' and check which argument is falsy per the (got key=..., message=...) hint in the message
Fail fast in support/setup code listing required envs before any test runs

Example fix

// before
cy.task('computeHmac', {
  key: Cypress.env('HMAC_KEY'),
  message: undefined,
});

// after
const key = Cypress.env('HMAC_KEY');
if (!key) throw new Error('HMAC_KEY env is required for signature computation');
cy.task('computeHmac', { key, message: JSON.stringify(requestBody) });

Defensive patterns

Strategy: validation

Validate before calling

// Before cy.task('computeHmac', ...)
const key = Cypress.env('HMAC_KEY');
if (!key) throw new Error('HMAC_KEY env is required to sign requests');
if (!message) throw new Error('computeHmac requires a non-empty message body');
cy.task('computeHmac', { key, message });

Try / catch

cy.task('computeHmac', { key, message }).then((sig) => sig, (err) => {
  if (/computeHmac: 'key' and 'message' are required/.test(err.message)) {
    throw new Error('Signing skipped: HMAC secret not configured for this environment');
  }
  throw err;
});

Prevention

Fail fast in support setup listing all required secrets (HMAC key etc.) before specs run
Always JSON.stringify the payload at the call site so message is never undefined
Use the (got key=..., message=...) fragment in the message to identify which argument was empty

When it happens

Trigger: cy.task('computeHmac', { key: Cypress.env('HMAC_KEY'), message: body }) where the HMAC secret env is unset (key undefined) or the message body is empty/undefined — the task throws with (got key=false, message=true)-style diagnostics.

Common situations: CI job missing the HMAC secret env var; local runs without the .env/bootstrap that provides signing keys; a spec computing a signature over an optional body that is undefined; empty-string secret after a bad env substitution.

Related errors

AI-assisted analysis of juspay/hyperswitch@9b8b89dc37 (2026-08-16). Data as JSON: /api/errors/f9f05ed679ffd8ba. Report an issue: GitHub.