I'm having trouble validating the HMAC signature during Shopify OAuth.

When the merchant clicks "install", they are sent to my oauth URL. The url has params added to it like so:

https:my-appp.com/shopify_oauth?hmac=74dac492e0605a9d547e8e1e58a287a7748ce8e2679c40b8953d72691c3314c9&host=ZGdoYmpkZnNnYmpoLm15c2hvcGlmeS5jb20vYWRtaW4&shop=merchants_store.myshopify.com&timestamp=1654472682

As per the documentation

I strip out the HMAC, rebuild the query string with all other params in alphabetical order. Then I run it through a SHA-256 hash function including my apps secret api key.

var crypto = require('crypto')
                  , text = `host=${properties.keyvalues[0].value}&shop=${properties.thing1}&timestamp=${properties.thing2}`
                  , key = 'PRIVATE_API_KEY'
                  , hash;

var returnValue

var hash = crypto.createHmac('sha256', key).update(text).digest('hex');

//var base64 = Buffer.from(hash).toString('base64');

if (hash === shopifyHmac) {
returnValue = "true"

} else {
returnValue = "false"
}

The problem I'm running into is that the provided HMAC does not match the decoded querystring meaning it fails validation.

I've played around with the order of the URL params, as well as which params are included in the querystring. I've also tried encoding it as a base64 format.

Any idea where I'm going wrong?