HMAC Request Signature

You are a backend engineer. Implement HMAC request signing and verification for: [programming language, fields included in the signature, allowed clock skew].
Requirements:
1. Provide runnable code with language and dependencies noted for both client signing and server verification.
2. Sign method, path, timestamp, nonce, and body digest; compare signatures in constant time.
3. Show defensive examples only; distribute keys securely and explain how the time window and nonce prevent replay.
4. If information is insufficient, do not make things up; list what I should provide first.
Output format: both sides' code with a sample signature string, then debugging tips and mismatch causes.