XOR with the secret key sounds like a good idea... hashing the whole file won't work though, since I want to check the hash before generating the file--I'm hash

XOR with the secret key sounds like a good idea... hashing the whole file won't work though, since I want to check the hash before generating the file--I'm hashing the URL to prevent an attacker from asking the server to generate billions of images. Think it will still work well if the input is only 20-30 characters?