I believe this can also error if shared_secret is unicode (even if it's just ASCII text in a unicode object because json.loads outputted it that way). hmac.new explodes rather than trying to coerce -- can we explicitly make that a string as well?