@brianrogers the sha2 of the attachment shouldn't take a hash, but it doesn't look like that's what you're using it for here anyway.

Since you've already got a shared secret, this hash doesn't add value, it's just a second shared secret, in effect a longer shared secret. (Not to mention this is a public repo). It would be much better to use a random nonce, and if we want to prevent timestamps use a nonce + a timestamp, and have the server reject requests that are too old or too far "in the future". Additionally the digest should include the body of the message we will send to the server, otherwise the request is subject to a MITM (man in the middle) attack, that is the request could be intercepted, the authentication left intact but the actual contained body of the request replaced with an arbitrary body.