[Fixed]-What options are there for verifying that mturk is requesting my ExternalQuestion and not a 3rd party?

Every request from AWS will include additional URL parameters: workerId, assignmentId, hitId. That’s probably the easiest way to identify a request coming from MTurk. There may be headers, as well, but they’re not documented anywhere.