src/SecureString.php
protected function hmac($str, $method, $password, $timestamp = 0, $throw = false) {
        if ($timestamp === 0) {
            $timestamp = time();
        }
        // Add the timestamp to the string.
        static::pushString($str, $timestamp);

        // Sign the string.
        $signature = hash_hmac($method, $str, $password, true);
        if ($signature === false) {
            return $this->exception($throw, "Invalid hash method $method.", 400);
        }

        // Add the signature to the string.
        static::pushString($str, static::base64urlEncode($signature));

        return $str;
    }
protected function hmac($str, $method, $password, $timestamp = 0, $throw = false) {
        if ($timestamp === 0) {
            $timestamp = time();
        }
        // Add the timestamp to the string.
        static::pushString($str, $timestamp);

        // Sign the string.
        $signature = hash_hmac($method, $str, $password, true);
        if ($signature === false) {
            return $this->exception($throw, "Invalid hash method $method.", 400);
        }

        // Add the signature to the string.
        static::pushString($str, static::base64urlEncode($signature));

        return $str;
    }
Sign a string with hmac and a hash method.

@param string $str The string to sign.
@param string $method The hash method used to sign the string.
@param string $password The password used to hmac hash the string with.
@param int $timestamp The timestamp used to sign the string with or 0 to use the current time.
@param bool $throw Whether or not the throw an exception on error.
@return string Returns the string with signing information or null on error.