Question

How to generate the secret key for the HMAC algorithm as I have to use it for data verification at the other clients end?

Thanks in advance.

Answer 1

The HMAC key must be pre-shared between the server and the client (both must known the key before you exchange messages).

You can generate the key in any way you want, for example by reading some bytes from /dev/random:

$fd = fopen('/dev/random', 'r');
$bytes = fread($fd, '64);

Then you can calculate the HMAC using hash_hmac:

$hash = hash_hmac('sha1', $data, $key);