diff --git a/src/helpers/signature.ts b/src/helpers/signature.ts
index e99e1ea..532433a 100644
--- a/src/helpers/signature.ts
+++ b/src/helpers/signature.ts
@@ -103,7 +103,7 @@ export function canonicalizeObject<T = unknown>(data: T): unknown {
  * @returns The canonical JSON string.
  */
 export function canonicalize(data: unknown, timestamp: number, nonce: string): string {
-  const body = canonicalizeObject(data)
+  const body = JSON.stringify(canonicalizeObject(data))
   return JSON.stringify({
     timestamp,
     nonce,
@@ -119,8 +119,9 @@ export function canonicalize(data: unknown, timestamp: number, nonce: string): s
  * @returns The signature.
  */
 export function sign(data: unknown, timestamp: number, nonce: string, secretKey: string): string {
+  const canned = canonicalize(data, timestamp, nonce)
   return createHmac('sha256', secretKey)
-    .update(canonicalize(data, timestamp, nonce), 'utf8')
+    .update(canned, 'utf8')
     .digest('hex')
 }
 
diff --git a/src/modules/device/router.ts b/src/modules/device/router.ts
index 14bd4b4..eb332d2 100644
--- a/src/modules/device/router.ts
+++ b/src/modules/device/router.ts
@@ -19,6 +19,7 @@ export const router = new Elysia({
     }
     return result
   }, {
+    verifyKey: true,
     body: deviceCommandBody,
     response: deviceCommandResponseSchema,
     detail: {
@@ -49,6 +50,7 @@ export const router = new Elysia({
       return { status: 'internal_error', message: 'Server error' }
     }
   }, {
+    verifyKey: true,
     query: deviceQueryParams,
     response: deviceQueryResponseSchema,
     detail: {