title: Shopify HMAC parameter verification failing in Python
body: <p>I'm having some trouble verifying the HMAC parameter coming from Shopify. The code I'm using per the <a href="https://help.shopify.com/api/getting-started/authentication/oauth#verification" rel="nofollow noreferrer">Shopify documentation</a> is returning an incorrect result.</p>
  
  <p>Here's my annotated code:</p>
  
  <pre><code>import urllib
  import hmac
  import hashlib
  
  qs = "hmac=96d0a58213b6aa5ca5ef6295023a90694cf21655cf301975978a9aa30e2d3e48&amp;locale=en&amp;protocol=https%3A%2F%2F&amp;shop=myshopname.myshopify.com&amp;timestamp=1520883022"
  </code></pre>
  
  <p><strong>Parse the querystring</strong></p>
  
  <pre><code>params = urllib.parse.parse_qs(qs)
  </code></pre>
  
  <p><strong>Extract the hmac value</strong></p>
  
  <pre><code>value = params['hmac'][0]
  </code></pre>
  
  <p><strong>Remove parameters from the querystring per documentation</strong></p>
  
  <pre><code>del params['hmac']
  del params['signature']
  </code></pre>
  
  <p><strong>Recombine the parameters</strong></p>
  
  <pre><code>new_qs = urllib.parse.urlencode(params)
  </code></pre>
  
  <p><strong>Calculate the digest</strong></p>
  
  <pre><code>h = hmac.new(SECRET.encode("utf8"), msg=new_qs.encode("utf8"), digestmod=hashlib.sha256)
  </code></pre>
  
  <p><strong>Returns <code>False</code>!</strong></p>
  
  <pre><code>hmac.compare_digest(h.hexdigest(), value)
  </code></pre>
  
  <p>That last step should, ostensibly, return true. Every step followed here is outlined as commented in the Shopify docs.</p>