Using a hash with a constant key to create easily verifiable codes
I will keep my answer short.

Yes it is trivial, in order to verify the code you need the parameters AND the key, thus there is no easy way to keep the key secure except through a hardware security module.

The correct way would be to use a digital signature:

Sign(SHA256(parameters),secret_key)


The signature can be verified by anyone with the public key, and the secret key is not required or exposed.