Skip to main content

Authentication V1

All API calls that touch a user account require authentication.

You must provide these headers on every private request:

  • X-PCK: API public key.
  • X-Stamp: Current time in milliseconds since the Unix epoch (UTC).
  • X-Signature: HMAC-SHA256 signature.
  • X-Nonce (optional): Size, in milliseconds, of the acceptable backward time window for X-Stamp. See Nonce window below.
success

For API key instructions visit API Access Permissions

X-Stamp​

X-Stamp is the current time in milliseconds since the Unix epoch (UTC). Keep your clock synchronised with NTP.

X-Nonce (time window)​

X-Nonce controls how far back in time a request's X-Stamp is allowed to be, relative to the server's clock:

  • If omitted or <= 0, it defaults to 5000 (5 seconds).
  • Values above 60000 (60 seconds) are clamped down to 60000.
  • A request is accepted only if:
now - X-Nonce  <=  X-Stamp  <=  now + 5000

That is, X-Stamp may be up to X-Nonce milliseconds in the past, and up to a fixed 5000 milliseconds in the future (this forward tolerance is not configurable). Requests outside this window are rejected with 401 Unauthorized - Invalid Nonce.

X-Signature​

X-Signature is a Base64-encoded HMAC-SHA256 signature computed over the concatenation of your public key and the X-Stamp value (publicKey + timestamp), signed with your Base64-decoded private key.

Each signature can be used for one request only; a repeated signature is rejected with 401 Invalid Signature. A signature is identified by your public key and X-Stamp, so give every request its own X-Stamp.

Code Example​

var apiKey = "YOUR_API_PUBLIC_KEY";
var apiSecret = "YOUR_API_SECRET";
var nonce = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
string message = apiKey + nonce;
using (HMACSHA256 hmac = new HMACSHA256(Convert.FromBase64String(apiSecret)))
{
   byte[] signatureBytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
   string xSignature = Convert.ToBase64String(signatureBytes);
}

// Headers to send:
// X-PCK: {apiKey}
// X-Stamp: {nonce}
// X-Signature: {xSignature}
// X-Nonce: 5000   (optional, defaults to 5000 if omitted)