secure login procedure
They're equally safe. HTTPS is designed against most MITM-related attacks, including replay attacks, so the only thing you have to ensure is that your client has the pre-shared key.

For the first method, it is ensured by the HMAC hash. For the second one it is ensured because only the client can decrypt the token.

However, storing keys reversibly on a server is not recommended because your server might be hacked. This can be solved by storing the hash of your client key on your server with some secure password hashing algorithm(bcrypt, PBKDF2, etc).