API needs SHA256 HMAC

Yes, instructions here