I tried following steps in Linux. Although, header and payload are not tampered, signature and output doesn’t match. What am I missing?
token="eyJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoiSm9lIENvZGVyIn0.5dlp7GmziL2QS06sZgK4mtaqv0_xX4oFUuTDh1zHK4U"
signature=$(echo $token | cut -f 3 -d '.')
secret_key_in_hex=$(echo -n $signature'=' | basenc -d --base64url | hexdump -ve '/1 "%02x"')
headpay=$(echo $token | cut -f -2 -d '.')
echo -n $headpay | openssl dgst -sha256 -macopt hexkey:${secret_key_in_hex} -mac hmac -binary | basenc --base64url | sed 's/=//'