Signature Authentication
Safety Certification
For the current apikey application and modification, please perform related operations on the
'Personal
Center - API Management' page. AccessKey is the API access key, and SecretKey is the key for the
user to
sign the request (visible only when applying).
● Important: These two keys are closely related to
account security and should not be disclosed to others at any time.
legal request structure
For security reasons, transaction-related API requests must be signed. A legitimate request consists
of
the following:
● Method request address The access server address: https://xxx/v1 is
followed by the method name, such as https://xxx/v1/order/saveEntrust.
● API access key (accessKey) The AccessKey in the APIKEY you requested, this parameter must be
added
to each api interface.
● Required and optional parameters Each method has a set of required and optional parameters for
defining API calls. These parameters and their meanings can be viewed in the description of each
method.
● When signing a secret, use a hash-based protocol and use the HmacSHA256 algorithm for
calculation
and verification.
● Signature The value calculated by the signature to ensure that the signature is valid and has
not
been tampered with.
Signature operation
The API request is very likely to be tampered with during the process of sending over the Internet.
To
ensure that the request has not been changed, we will ask the user to include a signature in the
method
request (whether or not each method requires a signature). Check if the parameter or parameter value
has
changed during transmission.
Signature calculation:
Note: When performing signature calculation, HMACSHA256 is used for signature encryption by default.
If
other encryption algorithms are used, the api cannot interpret the request data. Therefore, before
the
signature calculation, please normalize the request.
Example:
POST /v1/order/saveEntrust
order
● Note: In the https request path, the original request parameter value does not need to be sorted
and passed the value. Only the encrypted parameters need to be sorted, please know.
1.The path address is --/order/saveEntrust,The parameters are count, matchType,
payPwd, price, symbol, type, timestamp, accessKey. The accessKey is mandatory. This parameter
must be added to each api interface. If the parameter does not need to be checked, the signature
parameter may not be passed.
2.POST requested interface, parameters are passed in json mode. Lifting chestnuts: the following
singles
need to be checked.
https://xxx/v1/order/saveEntrust
JSONObject jsonObject = new JSONObject();
jsonObject.put("count",count);
...
jsonObject.put("accessKey",accessKey);
3.Sort the parameter names to be encrypted in the order of ASCII code. The original parameter format
is:
{"symbol":"ETHBTC","accessKey":*******,"matchType":"MARKET","price":1,"count":1,"payPwd":****,"type":"BUY","timestamp":"1566963399019"}
4.The order after sorting is:
String signString = Sign.jsonToString(jsonObject.toJSONString());
signString =
accessKey=*****&count=1&matchType=MARKET&payPwd=****&price=1&symbol=ETHBTC×tamp=1566963399019&type=BUY
5.Encrypt the sorted parameters to get the signature, use sha256_HMAC to encrypt the signature,
convert
the encrypted byte array to base64 and convert it to string, and add the signature to json:
String signature = Sign.sha256_HMAC(signString, SECRET_KEY);
jsonObject.put("signature",signature);
6.The final parameter json is:
{"symbol":"ETHBTC","accessKey":*****,"signature":*****,"matchType":"MARKET","price":1,"count":1,"payPwd":****,"type":"BUY","timestamp":"1566963399019"}
/POST request parameter must be json, other parameter API will not receive, json parameter
encryption is
the same as GET encryption. After encryption is completed, add signature in json: encrypted
ciphertext
parameter!