Alex Gleason, this is what the token looks like. I'll be sending it as
Authorization: ActivityPubActorToken <this json thing>
And this is in addition to an http signature of course.