Shared-key cryptography is the wrong choice for one-to-many communication. Public key cryptography solves this problem correctly. (You use public key cryptography to share a secret, which you then use as the key for whatever secret-key crypto you want to do.)
Consider the case of VPNs. When you have two trusted routers to connect, you use a shared secret. That's because both routers are in the same secured datacenter environment; both are equally trusted. When you have users connecting to your VPN, though, you issue each user a unique certificate (which is a crypto-based identifier). This is because you can't trust individual users the way you can trust a server in your datacenter.
I'm not talking about vpns and such but more about (rest-)api authentication. About what amazon uses to generate signed urls to S3-Stored files. It's an hmac used to create a signature using a pre-shared secret and some properties of the request (mainly the url) as input. The PSK must be available to both parties.
Consider the case of VPNs. When you have two trusted routers to connect, you use a shared secret. That's because both routers are in the same secured datacenter environment; both are equally trusted. When you have users connecting to your VPN, though, you issue each user a unique certificate (which is a crypto-based identifier). This is because you can't trust individual users the way you can trust a server in your datacenter.