Would appreciate any feedback on the article from any HN'ers that have done large-scale web APIs and run into any gotchas with different approaches. For exampl

Would appreciate any feedback on the article from any HN'ers that have done large-scale web APIs and run into any gotchas with different approaches. For example, is the format used to glob the param/value pairs together (besides using name=value) critically important as long as they are delimited appropriately? (avoiding AWS sig v1 issue). Or is the order of applying the private key and HMAC important? In the AWS example it looks like you prime the HMAC-sha1 instance with the private key, then sign the data... would that be the same as just appending the private key, the data, and the timestamp all together and signing that? Also, what do you think of the real-world implications of using the timestamp and an acceptable range on the server side to avoid "replay attacks" as a means of making an API a bit more secure? AWS doesn't use it... I was concerned with clients/servers being too far out of sync in some cases where the client may not be able to adjust it's system time easily OR an incorrect DST calculation between the two making the server think the client is suddenly 1hr more than it should be (namely at the switchover boundaries) Just a few thoughts that came to mind that I'd be curious to get feedback on from folks smarter than me.