In ROOT/modules/update/update.fetch.inc, there is the following code.

$site_key = drupal_hmac_base64($base_url, drupal_get_private_key());
$url = _update_build_fetch_url($project, $site_key);

_update_build_fetch_url() contains the following code.

  // Only append usage information if we have a site key and the project is
  // enabled. We do not want to record usage statistics for disabled projects.
  if (!empty($site_key) && (strpos($project['project_type'], 'disabled') === FALSE)) {
    // Append the site key.
    $url .= (strpos($url, '?') !== FALSE) ? '&' : '?';
    $url .= 'site_key=';
    $url .= rawurlencode($site_key);

    // Append the version.
    if (!empty($project['info']['version'])) {
      $url .= '&version=';
      $url .= rawurlencode($project['info']['version']);

    // Append the list of modules or themes enabled.
    $list = array_keys($project['includes']);
    $url .= '&list=';
    $url .= rawurlencode(implode(',', $list));

This function generates the URL to fetch information about project updates, returning a URL like http://updates.drupal.org/release-history/examples/7.x?site_key=FuSSIDdX3JtCJQV7F1hWK6WopklCLf0jjHFDC1Nevys&version=7.x-1.x-dev&list=ajax_example%2Cexamples.

Why does Drupal need site_key? How do I know the value of $base_url from site_key?


It's a unique value that allows to identify the site asking for updates. It is used on Drupal.org when giving the number of site using a module, which is shown in every project page.


Without that value, Drupal.org could not report the number of sites using a module, since it could not understand which site is asking for updates.

Since site_key is a crypted hash derived from $base_url, you cannot get the value of $base_url from its hash; that is how hash works. Hashes are used to save the passwords in the database; nobody can get the value of the password from the hash saved in the database.


I believe this is a unique token for each site, that Drupal reports when checking for updates. So the statistics (below the releases there is a 'view usage statistics' link) are checked against a token. Otherwise if you would check for updates 100 times, there would be in increased usage for all your modules.

So it enhances accuracy on Drupal.org backed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.