You don’t have to if you have the notion of an active unlock session.

Have you ever used aws sigv4 for s3 buckets? Pretty ubiquitous example of signed requests in practice.