Some hopefully constructive criticism. :)<p>- I'd recommend using HMAC rather than plain MD5 to generate signatures. Using MD5 alone exposes you to length extension attacks.<p>- You should consider putting a timestamp or nonce in the signature parameters to prevent replay attacks.<p>- The fact that you're able to validate that MD5(password) is correct implies that you're storing passwords insecurely.<p>- Consider switching your API endpoints to use HTTPS and sending the password unhashed. Hashing the password is not helping you here: since you're using the hashed value for authentication, any attacker who has it might as well have the actual password. Luckily, I don't believe this is as useful without also knowing the PSK, but it's still a design smell.