No longer needs stored HMAC id/key. Retrieves it on first authentication failure