gistfile1.php[345]

#!/usr/bin/php
<?php
$secret = 'n39niewh32iblk0';
$request = array(
    'issuer'         => 'mySuperClientID',
    'key_id'         => 'not sure if this is needed for OAuth since we have the client id',
    'alg'            => 'HMAC-SHA256',
    'not_before'     => time(),
    'token_lifetime' => 60000,
    'audience'       => 'http://resource.example.com/foo',
    'method'         => 'GET',
    'nonce'          => 'h21ibqw' . rand(),
    'token'          => '2kbiip21nibiopnb21o9bklb',
);

$req_payload = base64_encode(json_encode($request));
$req_signature = hash_hmac('sha256', $req_payload, $secret);
echo "Generating the request...\n";
$req_string = $req_payload . '.' . $req_signature;
echo "Request JSON Token:\n\t" . $req_string . "\n";

echo "Parsing the request...\n";
list($parse_payload, $parse_signature) = explode('.', $req_string);
echo "\tSignature: " . $parse_signature . "\n";
$parse_request = base64_decode($parse_payload);
$key_id = $parse_request['issuer']; // the client id to look up the secret
if ($parse_signature == hash_hmac('sha256', $parse_payload, $secret)) {
    echo "\tSignature verified!\n";
} else {
    die("Unable to verify signature");
}
echo "\t" . $parse_request . "\n";

Playing with JSON Tokens