попробуй вот так:
function check_hash($token){
$arr = $_GET;
$check_hash = $arr['hash'];
unset($arr['hash']);
$data_check_arr = explode('&', rawurldecode($check_hash));
$needle = 'hash=';
$check_hash = FALSE;
foreach( $data_check_arr AS &$val ){
if( substr( $val, 0, strlen($needle) ) === $needle ){
$check_hash = substr_replace( $val, '', 0, strlen($needle) );
$val = NULL;
}
}
$data_check_arr = array_filter($data_check_arr);
sort($data_check_arr);
$check_hash = implode("\n", $data_check_arr);
$secret_key = hash_hmac( 'sha256', $token, "WebAppData", TRUE );
$hash = bin2hex( hash_hmac( 'sha256', $check_hash, $secret_key, TRUE ) );
if(strcmp($hash, $check_hash) === 0){
return true;
}else{
return false;
}
}