ref

application/Espo/Core/Authentication/Logins/Hmac.php

@@ -71,12 +71,11 @@ class Hmac implements Login
         $string = $request->getMethod() . ' ' . $request->getResourcePath();
 
         // As of v8.4.1.
-        if ($hash === hash_hmac('sha256', $string, $secretKey)) {
+        if ($hash === ApiKey::hash($secretKey, $string)) {
             return Result::success($user);
         }
 
-        // To become a legacy.
-        if ($hash === ApiKey::hash($secretKey, $string)) {
+        if ($hash === ApiKey::hashLegacy($secretKey, $string)) {
             return Result::success($user);
         }
 

application/Espo/Core/Utils/ApiKey.php

@@ -39,6 +39,15 @@ class ApiKey
     {}
 
     public static function hash(string $secretKey, string $string = ''): string
+    {
+        return hash_hmac('sha256', $string, $secretKey);
+    }
+
+    /**
+     * @deprecated
+     * @internal
+     */
+    public static function hashLegacy(string $secretKey, string $string = ''): string
     {
         return hash_hmac('sha256', $string, $secretKey, true);
     }