I am working on a public API for my personal forum. Concerning the authentification of the requests and responses I plan to hash the payloads with a secret, known to me and the API user, and send the result to the API user in response header. This way he can make sure, that the response really came from me. An incoming request must have a hash in the header as well to make sure, it was send bei the API user.
When I had a look on how facebook deals with this problem in their graph API I explored, that they indeed hash their responses, but the requests must be sent via an access_token. @see https://developers.facebook.com/docs/messenger-platform/webhook-reference#security
This way, there must be two secrets between client and facebook (access_token and app_secret).
What are the advantages of facebook's method AND why don't they use the hashing in both directions?
I hope I made my problem clear and am happy for your help! :-)