Instead of requiring that a user hash be computed based on HMAC-SHA256, expose some API devs can call to automatically generate this based when the verifications ecret is passed in.