Use hmac for secret verification