using System;

using System.Text;

using System.Security.Cryptography;

​

public class Program

{   

    public static void Main()

    {           

        var payload = "eyJ1c2VySWQiOjE3MDc2MS4wLCJ1c2VyTmFtZSI6bnVsbCwiZW1haWwiOm51bGwsInJvbGVzIjpbIkFsbCBQcml2aWxlZ2VzIiwiRmluYW5jZSIsIlRpY2tldFJlYWRlciIsIkxvZ2lzdGljcyIsIlBvcnRhbCBBZG1pbmlzdHJhdG9yIiwiTG9naXN0aWNzIE1hbmFnZW1lbnQiLCJTaXRlIEVDRyBSZXBvcnQgUmVjZWl2ZXIiLCJFZHVjYXRpb24iLCJTaGlwcGluZyBDb250YWN0IiwiU2l0ZSBEQ0YgUmVjZWl2ZXIiLCJQcmluY2lwYWwgSW52ZXN0aWdhdG9yIiwiUHJvamVjdCBNYW5hZ2VyIl0sImN1cnJlbnRTdHVkeSI6IlNWX0FNM19TVFVEWTAyIiwiY29uc3RyYWludHMiOlt7InN0dWR5Ijp7InNwb25zb3JOYW1lIjoiU0lNVUxBVElPTiIsInByb3RvY29sQWNjb3VudCI6IjA1OTI4MSIsIm5hbWUiOiJTVl9BTTNfU1RVRFkwMiIsImlkIjoyMTIzNy4wLCJhY2Nlc3NMZXZlbCI6InN0dWR5Iiwic2l0ZXMiOm51bGx9fV19";

        // TextEncoding.Base64Url.Decode is nothing special and is Base64 decoding with replacement of some unsafe characters '-' to '+' or '_' to '/' and adding '=' for padding to the end,

        // result will look like BMw3M+TtOT9ScFBpsIH12W57wds3jEYnJHS7ixUDg3Y=

        //byte[] key = Microsoft.Owin.Security.DataHandler.Encoder.TextEncodings.Base64Url.Decode("BMw3M-TtOT9ScFBpsIH12W57wds3jEYnJHS7ixUDg3Y");       

        byte[] key = Jose.Base64Url.Decode("BMw3M-TtOT9ScFBpsIH12W57wds3jEYnJHS7ixUDg3Y");

        byte[] message = Encoding.UTF8.GetBytes(payload);

        string sig = Convert.ToBase64String(HashHMAC(key, message));

        Console.WriteLine("Producded: " + sig);

        Console.WriteLine("Expected:  POQamjUO0Uzq8XvEBhNySJNCW5+We+wtfwglHsRIOYc=");   

    }

    private static byte[] HashHMAC(byte[] key, byte[] message)

    {

        var hash = new HMACSHA256(key);

        return hash.ComputeHash(message);

    }

}