We use RSA signed JWTs for quite a few services and it's been a joy so far. Makes key rotation without downtime super easy and (obviously) doesn't have any of the dangers associated with a shared secret.

https://github.com/crgwbr/asymmetric_jwt_auth