Yubico Forum

Checking the hash is optional. However, Yubico recommend all production deployments use either API key or HTTPS to secure the OTP validation communication.

bump

.

.

https instead of hmac verificiation is secure enough and more easy.
But anyway, check this attachment for some hmac verification code I wrote quickly if you want to implement it anyway.
Just make sure the API key is securely stored on your server! There is no way telling if someone forged an 'OK' status if they aquired this key.

I'm confused is the generated Client ID the AuthID?

You are basically right, but supporting signing the request even when SSL is used has the advantage of letting the server identify the client.

YubiCloud currently does not make use of this, but it could become important in the future to mitigate DoS attacks against the service.

Also, using HMAC signatures to validate the servers response could perhaps feel better than trusting your typical list of 100+ trusted SSL CAs. Not that you would necessarily be using such a list for validating the YubiCloud servers SSL certificates, but...

/Fredrik