python POST request with TOTP for HMAC SHA512

I'm supposed to send data trough a POST with HMAC-SHA-512 with a TOTP password protection.
I can't get this to work and I don't understand why, I really need help with this.

The code :

import httplib2
import hmac
import hashlib
import time
import sys
import struct
import json

root = "https://url.com/url"
content_type = "application/json"
userid = "sample@email.com"
secret_suffix = "SECRETSUFFIX"
shared_secret = userid+secret_suffix

timestep = 30
T0 = 0

def HOTP(K, C, digits=10):
    """HTOP:
    K is the shared key
    C is the counter value
    digits control the response length
    """
    K_bytes = str.encode(K)
    C_bytes = struct.pack(">Q", C)
    hmac_sha512 = hmac.new(key = K_bytes, msg=C_bytes, digestmod=hashlib.sha512).hexdigest()
    return Truncate(hmac_sha512)[-digits:]

def Truncate(hmac_sha512):
    """truncate sha512 value"""
    offset = int(hmac_sha512[-1], 16)
    binary = int(hmac_sha512[(offset *2):((offset*2)+8)], 16) & 0x7FFFFFFF
    return str(binary)

def TOTP(K, digits=10, timeref = 0, timestep = 30):
    """TOTP, time-based variant of HOTP
    digits control the response length
    the C in HOTP is replaced by ( (currentTime - timeref) / timestep )
    """
    C = int ( time.time() - timeref ) // timestep
    return HOTP(K, C, digits = digits)

data = { "github_url": "https://gist.github.com/YOUR_ACCOUNT/GIST_ID", "contact_email": "sample@email.com" }

passwd = TOTP(shared_secret, 10, T0, timestep) 

h = httplib2.Http()
h.add_credentials( userid, passwd )
header = {"content-type": "application/json"}
resp, content = h.request(root, "POST", headers = header, body = json.dumps(data))
print(resp)
print(content)

The instructions :

Description

First, construct a JSON string like below:

{ "github_url": "https://gist.github.com/YOUR_ACCOUNT/GIST_ID", "contact_email": "EMAIL" }

Fill in your email address for EMAIL, and the path to your secret gist for YOUR_ACCOUNT/GIST_ID. Be sure you have double-checked your email address; we will contact you by email.

Then, make an HTTP POST request to the following URL with the JSON string as the body part.

https://url.com/url

Content type

The Content-Type: of the request must be application/json. Authorization

The URL is protected by HTTP Basic Authentication, which is explained on Chapter 2 of RFC2617, so you have to provide an Authorization: header field in your POST request

For the userid of HTTP Basic Authentication, use the same email address you put in the JSON string.
For the password, provide a 10-digit time-based one time password conforming to RFC6238 TOTP.

Authorization password

For generating the TOTP password, you will need to use the following setup:

You have to read RFC6238 (and the errata too!) and get a correct one time password by yourself.
TOTP's Time Step X is 30 seconds. T0 is 0.
Use HMAC-SHA-512 for the hash function, instead of the default HMAC-SHA-1.
Token shared secret is the userid followed by ASCII string value "SECRETSUFFIX" (not including double quotations).

I keep getting :

"message": "Access denied: Invalid token