hmac_laravel.php

public function verifyRequest(Request $request, $secret) {
    // Per the Shopify docs:
    // Everything except hmac and signature...
    $signature = $request->except(['hmac', 'signature']);

    // Sorted lexilogically...
    ksort($signature);

    // Special characters replaced...
    foreach ($signature as $k => $val) {
    	$k = str_replace('%', '%25', $k);
    	$k = str_replace('&', '%26', $k);
    	$k = str_replace('=', '%3D', $k);
    	$val = str_replace('%', '%25', $val);
    	$val = str_replace('&', '%26', $val);
    	$signature[$k] = $val;
 	}

    // Hashed per hmac standards, using sha256 and the shared secret
    $test = hash_hmac('sha256', http_build_query($signature), $secret);

    // Verified when equal
    return $request->input('hmac') === $test;
}

hmac_vanilla.php

public function verifyRequest($request, $secret) {
    // Per the Shopify docs:
    // Everything except hmac and signature...
    $hmac = $request['hmac'];
    unset($request['hmac']);
    unset($request['signature']);

    // Sorted lexilogically...
    ksort($request);

    // Special characters replaced...
    foreach ($request as $k => $val) {
        $k = str_replace('%', '%25', $k);
        $k = str_replace('&', '%26', $k);
        $k = str_replace('=', '%3D', $k);
        $val = str_replace('%', '%25', $val);
        $val = str_replace('&', '%26', $val);
        $request[$k] = $val;
    }

    // Hashed per hmac standards, using sha256 and the shared secret
    $test = hash_hmac('sha256', http_build_query($request), $secret);

    // Verified when equal
    return $hmac === $test;
}