It's mostly a matter of setting up an endpoint in your app to sign manifests using the secret key. It's give or take a dozen lines of code on the backend (to do it in an "unsophisticated way"), and was one of the first things I wrote in Elixir! These two links should get you on your way:

1. http://bencoe.tumblr.com/post/30685403088/browser-side-amazo...

2. https://aws.amazon.com/articles/1434/?tag=vig-20