HMAC Creation in JAVA - HTTP 403 - HMAC validation Failure

Hi,
I'm getting the following message back from the API.

message=HTTP error processing FirstData transaction, httpStatusCode=403, httpStatusText=Forbidden, responseBody={"code":"403", "message":"HMAC validation Failure"}

I assume, I have an error in my HMAC creation, but I cant seem to find it.

Could anyone help? Thanks!

private HttpHeaders createPayEezyHeaders(String contentType, String apiKey, String apiSecret, String merchantToken, String payload) throws Exception {
Map securityKeys = getSecurityKeys(apiKey, apiSecret, merchantToken, payload);

HttpHeaders headers = new HttpHeaders();
headers.add("Content-Type", contentType);
headers.add("apikey", apiKey);
headers.add("token", merchantToken);
headers.add("nonce", (String) securityKeys.get(SecurityUtil.NONCE));
headers.add("timestamp", (String) securityKeys.get(SecurityUtil.TIMESTAMP));
headers.add("Authorization", (String) securityKeys.get(SecurityUtil.AUTHORIZE));
return headers;
}

private Map getSecurityKeys(String apiKey, String apiSecret, String merchantToken, String payLoad) throws Exception {
Map returnMap = new HashMap<>();
returnMap.put(SecurityUtil.NONCE, SecurityUtil.getNonce());
returnMap.put(SecurityUtil.APIKEY, apiKey);
returnMap.put(SecurityUtil.TIMESTAMP, Long.toString(System.currentTimeMillis()));
returnMap.put(SecurityUtil.TOKEN, merchantToken);
returnMap.put(SecurityUtil.APISECRET, apiSecret);
returnMap.put(SecurityUtil.PAYLOAD, payLoad);
try {
returnMap.put(SecurityUtil.AUTHORIZE, SecurityUtil.getMacValue(returnMap));
} catch (NoSuchAlgorithmException e) {
log.error("message=Error occurred while creating authorize header for first data transaction", e);
throw new RuntimeException("message=Error occurred while creating authorize header for first data transaction", e);
}
return returnMap;
}

public static String getMacValue(Map data) throws Exception {
Mac mac = Mac.getInstance("HmacSHA256");
String apiSecret = data.get(APISECRET);
SecretKeySpec secret_key = new SecretKeySpec(apiSecret.getBytes(), "HmacSHA256");
mac.init(secret_key);
StringBuilder buff = new StringBuilder();
buff.append(data.get(APIKEY))
.append(data.get(NONCE))
.append(data.get(TIMESTAMP));
if (data.get(TOKEN) != null) {
buff.append(data.get(TOKEN));
}
if (data.get(PAYLOAD) != null) {
buff.append(data.get(PAYLOAD));
}
log.info("HMAC=" + buff.toString());
byte[] macHash = mac.doFinal(buff.toString().getBytes("UTF-8"));
String authorizeString = new String(Base64.encodeBase64(toHex(macHash)), "UTF-8");
return authorizeString;
}

public static byte[] toHex(byte[] arr) {
String hex = String.valueOf(Hex.encodeHex(arr));
return hex.getBytes();
}