hmac is optional