Include HTTP_METHOD in signature to fix POST. The older code had http_method="GET" hard-wired, so any POST to the API would result in a failed signature ...