Hacker News Reader

I make an API, for narrow use case. All calls have to be from a registered UA, among other things forms the HMAC sig.

You have created a perverse-sounding design.

This sounds like authentication with extra steps? Why not just send a bearer token?

We do. Header is for message signing. And UA has to be registered, part of the spec provided by client.