now using sha256 to verify the auth code