Using a random string to authenticate HMAC?

I am designing a simple webservice and want to use HMAC for authentication to the service.

Are python’s cryptographic modules good enough?

I mean, say you were writing professional grade software that would involve sensitive client information. (Take this in the context of me being an amateur programmer.)

Validating time-limited HMACs

I’m exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion.