Great question — answering as the UphillTech team:
So you are building a hash which includes a shared key. This provides a guarantee that the values of $code, $shop and $timestamp haven't been tampered with and that the request came from someone who has your shared key. So I can think of the following scenarios which would lead to this: $shared_secret, $code, $shop, $timestamp have been tampered with (unlikely) The method to calculate the hash is wrong - $signature_data = $shared_secret . "code=" . $code . "shop=". $shop . ".myshopify.comtimestamp=" . $timestamp; (unlikely if it's example code) The md5 on your client is broken (unlikely) BTW I'm surprised you don't need to base64 encode somewhere. (unlikely if you haven't changed the sample...
Full answer by Daniel James Bryars: https://stackoverflow.stackexchange.com/a/36234845 (CC BY-SA 4.0).
Want it for your business? UphillTech.