This looks very much like the approach to session-data-in-encrypted-and-signed-cookie I've seen used to great success in lots of places (where for a stateless-ish API the contents are just a user id or whatever).

Am I right that this would work fine both in that or in e.g. a query parameter?

(sorry if I'm asking really stupid questions, but I'd rather look stupid than accidentally a security hole)