this service just passes the signature without integration key
It doesn't, although I can forgive you for making that mistake. The function name is a bit misleading.
sign_request isn't a particularly accurate description of what it does. It MACs the request (I assume they say "sign" simply because the average developer will have no idea what a MAC is), but it also includes the request itself in the returned data.
ikey = '3pA0XSAwHBOkyGH43WlZ'
skey = '21FNMyZQ15c4GqTHzUnJUGpYTp35LXieMfxAulY3'
akey = 'rVbrzSNJNBKyspIZgabSt3m8C6zIs20zrJF27t65'
username = 'johndoe'
sign_request will return:
Picking that apart:
TX is the hard-coded "
am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQwNDY0 is the base64 encoding of
johndoe|3pA0XSAwHBOkyGH43WlZ|1548340464, which is
username|ikey|expiration-timestamp (expiration being 5 minutes from the current time)
f8ab99bf117ec109c16b7193b5be7e16238a46f8 is the hex-encoded MAC of
APP is the hard-coded "
am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQzNzY2 is the base64 encoding of
johndoe|3pA0XSAwHBOkyGH43WlZ|1548343766, which is
username|ikey|expiration-timestamp (expiration being 1 hour from the current time)
307f27ee3ea75c09c2f2b4e8b3089b49c167b88f is the hex-encoded MAC of
ikey is actually included twice in the request.