validate_hmac.php

// Set variables for our request
$shared_secret = "TBB5wltKarRtKn5mUVZck9RxHePNN6Jo";
$params = $_GET; // Retrieve all request parameters
$hmac = $_GET['hmac']; // Retrieve HMAC request parameter
$params = array_diff_key($params, array('hmac' => '')); // Remove hmac from params
ksort($params); // Sort params lexographically

// Compute SHA256 digest
$computed_hmac = hash_hmac('sha256', http_build_query($params), $shared_secret);

// Use hmac data to check that the response is from Shopify or not
if (hash_equals($hmac, $computed_hmac)) {
	// VALIDATED
} else {
	// NOT VALIDATED – Someone is trying to be shady!
}

Modified from https://github.com/nyalex/shopify-generating-api-token-guide/blob/master/generate_token.php