create an API firewall checking authorization and request body signature