Have you looked into WebAuthn[1]? It seems pretty similar to what you want to do and could provide some answers to some of your questions. Also, you could set

Have you looked into WebAuthn[1]? It seems pretty similar to what you want to do and could provide some answers to some of your questions. Also, you could set a timestamp in the headers and include those in the signature (like Slack & AWS do), while remembering to reject any request using a timestamp that’s too old for it’s signature. [1]: https://webauthn.guide/ https://webauthn.guide/