3 ms·

I make an API, for narrow use case. All calls have to be from a registered UA, among other things forms the HMAC sig.

• sk5t 7y ago
  You have created a perverse-sounding design.
• neikos 7y ago
  This sounds like authentication with extra steps? Why not just send a bearer token?
  • edoceo 7y ago
    We do. Header is for message signing. And UA has to be registered, part of the spec provided by client.