API Design · Senior · Question 72 of 75
What does request signing (e.g. HMAC-based like AWS SigV4) add beyond a bearer token?
- 1Faster responses
- ✓Correct answer: Proof that the request body and key headers weren't altered, plus replay protection with timestamps, without sending the secret itself
- 3Automatic API versioning
Explanation
Signing is common for server-to-server APIs and webhooks where integrity matters.