PHP curl post request with JWT signatures aren't matching - php

Question

i am trying to verify the signature of a jwt im sending but it doesnt match, despite making sure that both payload and header are identical.
here is my client code, the one sending the jwt:
<?php
$ch = curl_init();
$handle = fopen("C:/xampp/htdocs/video/charmscene.mp4", "rb");
$contents = fread($handle, filesize("C:/xampp/htdocs/video/charmscene.mp4"));
fclose($handle);
//encode binary file to 64 because json doesnt support binary
$encoded_file = base64_encode($contents);
//serialize -> 64enc ->json enc
$header = ['typ' => 'JWT', 'alg' => 'HS256'];
$payload = ["filename"=>"charmscene","api"=>"VALIDAPIKEY"];
$secret = "thisisasecret";
$headerenc = base64_encode(serialize($header));
$payloadenc = base64_encode(serialize($payload));
$signature = hash_hmac("SHA256",$headerenc .".".$payloadenc, $secret,true);
$signature_enc = base64_encode($signature);
$jwt = $headerenc.".".$payloadenc.".".$signature_enc;
curl_setopt($ch, CURLOPT_URL, "http://localhost/app/webservice/api/index.php?clients=123");
$requestheaders = ['Accept: application/json', "WWW-Authenticate: Bearer ".$jwt];
curl_setopt($ch, CURLOPT_HTTPHEADER, $requestheaders);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Get the payload of the response:
$responsedata = curl_exec($ch);
echo $responsedata;
curl_close($ch);
?>
and heres the function that deciphers the jwt:
function decipherJwt($jwt)
{
//the secret is shared between client and server beforehand
$secret = "thisisasecret";
$type= strtok($jwt," ");//bearer
$token = substr($jwt,strpos($jwt," "));
$parts = explode(".",$token);
$headerenc = $parts[0];
$payloadenc= $parts[1];
$signatureenc= $parts[2];
$signature = $signatureenc;
$signature2 = base64_encode(hash_hmac("SHA256",$headerenc ."." .$payloadenc, $secret,true));
if($signature!=$signature2)
{
echo "signature doesn't match content";
echo $signature;
echo "</br>";
echo $signature2;
return;
}
return array(unserialize(base64_decode($headerenc)),unserialize(base64_decode($payloadenc)), $signature);
}
the signatures just dont match and i dont get why.