Why are you "signing" your data at all? You're doing it wrong. Use SSL to secure the whole transport; use form or HTTP auth to make sure you know who you're talking to.

Signing requests with an HMAC provides end-to-end authentication, which is vastly superior to transport-level authentication such as HTTP auth.

You skipped the HTTPS part of my recommendation, which is vastly superior to homebrewed HMAC.

HTTPS is irrelevant to what I said. End-to-end authentication is better than transport-level authentication. Using an HMAC to sign requests and then sending those signed requests over HTTPS is better than using HTTP auth over HTTPS.

Yes, but what you said is irrelevant to what I said, and so we are at an impasse. =)