use hmac signing for incomign API requests
generate and return access and secret keys