Well, their developers were struggling understanding how to compute HMAC (we had to also write some pseudocode to help them compute urlsafe-base64, very complex challenging sophisticated stuff, yes) (this was a few years ago) when integrating into previous employer's API (was helping with their integration into us).
So I am zero percent surprised this happened, literally 0% surprise factor.
So I am zero percent surprised this happened, literally 0% surprise factor.