Is it safe to hash a packet with a shared secret to prove authenticity? I am developing an online game, where the server is written in Node.js and the client uses Godot. The issue is that Godot has no cryptographic functionalities (it can only encrypt and decrypt files, not elements in memory). 

As implementing cryptographic functionality would be out of my capabilities with Godot, I've been thinking of a way to authenticate UDP packets. 

I have the following idea: client logs in via HTTPS and gets a refresh token, and a shared (with the server) secret. The refresh token is used to renew the secret every 10 mins. 

To authenticate UDP packets (which are sent unencrypted), the packet contents are hashed with the secret included, the packet is sent with the hash. Then the other side verifies that the hash with the secret is valid. 

Is this approach secure enough? Considering that the secrets would be randomly generated long strings, would an attacker be able to calculate the secret by analizing several packets? My options for hashing are MD5 and SHA256 which are the algorithms available in Godot. 

Being that UDP is only used for game events which don't need extreme security (so no personal information, payment details etc are ever sent in this channel), would this work?
From what you I described I understand your scheme to be following:
Each message $M$ gets a tag $T$ which is $H(S \mathbin\| M)$ where $H$ can be MD5 or SHA2 and $S$ is a common secret. Both hash functions are vulnerable to a length-extension attack effectively allowing to compute $H(S\mathbin\|M\mathbin\|x)$ from $H(S\mathbin\|M)$ and the length of $M$ so your scheme should not be used for authentication.

A better alternative would be to use a message authentication code (short MAC), which is a group of algorithms specifically crafted for cases similar to yours, including the widespread HMAC which allows to turn even broken hash-algorithms like MD5 into relatively secure MAC's.