I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The salt is appended to the content, to make it harder to decrypt.
The API will be used by a few clients and the data is not very sensitive (for now). We will be doing IP filtering on our server.
What is the best practice, using a salt, a secret, or both ? It's kind of cumbersome for the client to have both I think.