Hash-based Message Authentication Code (HMAC) is a message authentication code that uses a cryptographic key in conjunction with a hash function.
Hash-based message authentication code (HMAC) provides the server and the client each with a public and private key. The public key is known, but the private key is known only to that specific server and that specific client. The client creates a unique HMAC, or hash, per request to the server by combing the request data and hashing that data, along with a private key and sending it as part of a request. The server receives the request and regenerates its own unique HMAC. The server compares the two HMACs, and, if they're equal, the client is trusted and the request is executed. This process is often called a secret handshake.
What makes HMAC more secure than Message Authentication Code (MAC) is that the key and the message are hashed in separate steps.
Per
http://searchsecurity.techtarget.com/
To anyone thinking that you can crack HMAC, this pretty proves you can't unless you have access to the server or public key. If you ask me this is a good thing, actually something powerful that bots can't crack.