Thanks. It's not clear to me from the post that it's using TLS but that would make sense. Though if requiring TLS I wonder why not just use basic auth since it'

Thanks. It's not clear to me from the post that it's using TLS but that would make sense. Though if requiring TLS I wonder why not just use basic auth since it's simpler and since TLS would protect the password. One of the things that's neat about, say, OAuth's MAC authentication, is that it works over plain old HTTP without TLS. Likewise for the AWS API's signature-based security scheme. Sounds like I erroneously assumed that this was aiming to do similarly.