SHA256 hashMessage: ('test' , 'APIKey') hex
that's what i initially thought.. but the php code they show is a little bit different.. the line that puts it together is: hash_hmac('sha256', $payload, $secret, $raw = true) in this case: parameters are: algorithm string to be hashed Shared secret key used for generating the HMAC variant of the message digest. When set to TRUE, outputs raw binary data. FALSE outputs lowercase hexits. so, i think i need to use the apiSecret as the key for encryption.. -- ---- peace, sergio photographer, journalist, visionary http://www.ThoseOptimizeGuys.com http://www.CodingForHire.com http://www.coffee-black.com http://www.painlessfrugality.com http://www.twitter.com/sergio_101 http://www.facebook.com/sergio101