Comment by sandeepkd

There is also a model where the applications sign the payload using the secret, AWS is a big user of that across all its API's.