[Fixed]-Design an encrypted time-limited API on Client/Server side

I think this will address your objectives:

1. Create an access key and a secret key for each user who is allowed to make requests.
2. Give one copy of each key to the user and keep one copy of each key on the server.
3. Add the following two parameters to each request: timestamp, and access key
4. Require that when the user sends a request, she creates a string of the post request, along with a timestamp parameter, and hash it using SHA256, using the secret key. (any hashing algo will do)
5. Create a parameter named Signature in your Post request, and use the hashed string as the value of the signature.
6. When the request reaches the server, use the access key to retrieve that user’s secret key, and hash the request again. This will re-create the signature. The signature created at the server and one sent by the user must match.

If the two signatures don’t match, discard. This way, anyone listening on the wire will have the url as well as the access keys, but will not be able to create a valid signature without the secret key associated with the access key.

Since there is a timestamp involved, the attacker will not be able to re-use a stolen signature.

Amazon uses this technique. http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html