code: def verify_payload(signed_payload, client_secret):
          
          encoded_json, encoded_hmac = signed_payload.split('.')
          dc_json = base64.b64decode(encoded_json)
          signature = base64.b64decode(encoded_hmac)
          expected_sig = hmac.new(client_secret.encode(), base64.b64decode(encoded_json), hashlib.sha256).hexdigest()
          authorised = hmac.compare_digest(signature, expected_sig.encode())
          return json.loads(dc_json.decode()) if authorised else False
docs: Given a signed payload (usually passed as parameter in a GET request to the app's load URL) and a client secret,
          authenticates the payload and returns the user's data, or False on fail.
  
          Uses constant-time str comparison to prevent vulnerability to timing attacks.