This Gist defines a mechanism for authenticating and signing API requests.
The authentication is passed from client to server via an "Authentication" HTTP Header. This includes a Hashed Message Authentication Code (HMAC). The HMAC is computed from all of the message parameters (request type, request URL, GET string, POST Parameters and/or POST body).
The data is signed with a pre-shared secret key provided to the client via some secure channel. In the case of server-to-server communication the secret key is likely to be hard-coded into a configuration file. In the case of browser-to-server communication the key ID and secret key would be passed to the client at the end of a successful login process.
The key ID enables the server to communicate with and identify a number of different client accounts. The server must have some mechanism for storing the keys of a number of client accounts and retrieving these based on the key ID. In the code below this is achieved by the secretKey