Use HMAC instead of OAuth