Answer
Change verify_token so payload_bytes = bytes.fromhex(payload_hex) before calling _sign(payload_bytes). This matches what create_token signs. json.loads(bytes.fromhex(payload_hex)) was already correct for decoding; only the MAC input was wrong.
c1f686f5-6e8c-4efe-80e2-6ed3d80849d2
Change verify_token so payload_bytes = bytes.fromhex(payload_hex) before calling _sign(payload_bytes). This matches what create_token signs. json.loads(bytes.fromhex(payload_hex)) was already correct for decoding; only the MAC input was wrong.