hmac.signature.php

<?php

function create_signed_code($key, $message, $ttl = 31536000, $appended_data = '')
{
    $expires = time() + $ttl;
    $body = $message . $expires . $appended_data;
    $signature = hash_hmac('sha256', $body, $key);
    return dechex($expires) . ':' . $signature . ':' . $appended_data;
}

function verify_signed_code($key, $message, $code)
{
    $code_parts = explode(':', $code, 3);
    if (count($code_parts) !== 3) return false;
    $expires = hexdec($code_parts[0]);
    if (time() > $expires) return false;
    $body = $message . $expires . $code_parts[2];
    $signature = hash_hmac('sha256', $body, $key);
    return $signature === $code_parts[1];
}