Ask HN: HMAC Authentication?

Hey guys,

Writing an API here. In the past for authentication, I've had people include an Authorization: token token=blah in the header.

Since SSL might not be an option for some of our customers (yes, sigh), and to guard against replay attacks, we need to encode the token somehow.

I noticed amazon uses HMAC, so I set out to create something similar. No, I'm not trying to make my own crypto, I'm trying to use the cryptographic primitives as they were intended:

Authorization: hmac_v0 time=urlEncode(iso8601(currentTimeStamp())), username=urlEncode(username()), nonce=urlEncode(base64(random(15))), sig=urlEncode(base64(HMAC("SHA-512", base64^-1(secretKey()), bytes(time+":"+username()+":"+nonce))))

Thoughts welcome!