Signing a Request Using HMAC SHA256
SIGNED endpoints require an additional Signature header to verify the authenticity of the request. Follow the steps below to compute a signature using HMAC SHA256.
How to compute the signature with HMAC SHA256
The signature is generated using the HMAC SHA256 algorithm. This method combines your SecretKey and the uri?totalParams to produce a unique code. The generated signature is not case sensitive.
totalParams consists of the query string (parameters in the URL) concatenated with the request body (payload).
Your secretKey should remain private and never be included in the request.
This ensures the security of your API interactions by validating the sender and protecting against unauthorized requests.
Prepare the payload
Concatenate the query string and the request body to create the signature payload totalParams. Ensure the data is formatted consistently.
Generate the binary signature
Use the HMAC SHA256 algorithm with your secretKey as the key and totalParams as the data.
Encode the signature
Convert the binary output of the HMAC operation to a hexadecimal string.
How to send a signed API request
Once the signature is computed, include it in the API request as follows:
Add the Signature to the request header
Include the computed signature in the Signature header of your request.
Include your API Key
Add your Quentrade APIKey in the request header.
Send the request
Ensure the request method, headers, and payload are identical to those used during signature computation to avoid mismatches.
How to Sign the Request
Below is a step-by-step example of how to send a valid signed payload from the Linux command line using echo, openssl, and curl. Here are examples of signed endpoints, along with step-by-step guides for interacting with them.
Example with Endpoint
API Credentials:
Request Parameters
Generating the HMAC SHA256 Signature
After running the command, you'll get the signature:
Making the API Call
curl -X POST 'https://quentrade.com/api/v1/user/mode?mode=paper' \ -H 'APIKEY: vmPUZE6mv9SD5VNHk4HlWFsOr6aKE2zvsw0MuIgwCIPy6utIco14y7Ju91duEh8A' \ -H 'Signature: 2b426474cee8133cc3a5ff0a296958daf1ef3b9f4c19f3aa8a21a42c771ae960'
How to Send the Signed Request via Postman
Here is a step-by-step example of how to call your endpoint through Postman. Once Postman works with the values, you can implement it in code.
Example with Endpoint
1. Set up GET url
With include_events:
By using include_events in the query string, in Postman, your Params field will be automatically filled in.
2. Calculate your Signature
Use a HMAC SHA256 generator tool.
3. Set up Headers
These 2 key/value pairs can be entered in Postman under Headers (which is located under the GET url field).
4. Receive JSON object
If you have followed these steps you should now receive a status 200 OK with your JSON data.