Using a hash with a constant key to create easily verifiable codes I'll keep my question short. If I keep handing out different codes generated by this function, will it be trivial to figure out the secret key?

secret_key = {random bytes}

function generate_code(parameters)
  return sha256(parameters + secret_key)


I know little about these things. What I like about this function is that it's trivial to verify if a code is valid given the same parameters. If this is a bad way of achieving this, what is a better way?
I will keep my answer short.

Yes it is trivial, in order to verify the code you need the parameters AND the key, thus there is no easy way to keep the key secure except through a hardware security module.

The correct way would be to use a digital signature:

Sign(SHA256(parameters),secret_key)


The signature can be verified by anyone with the public key, and the secret key is not required or exposed.