hmac fixed for new API