Authentication

Overview

MintMove API uses API key-based authentication with HMAC-SHA256 signature verification. All private endpoints require authentication to ensure that only authorized applications can access sensitive operations like creating orders and accessing order details.

API Credentials

You need two pieces of information to authenticate:

Required Headers

All authenticated requests must include the following headers:

Signature Generation

The signature is generated using HMAC-SHA256. Here's how it works:

Code Examples

const crypto = require('crypto');

function generateSignature(method, path, body, timestamp, apiSecret) {
  const signString = method + path + (body ? JSON.stringify(body) : '') + timestamp;
  const signature = crypto
    .createHmac('sha256', apiSecret)
    .update(signString)
    .digest('hex');
  return signature;
}

// Example usage
const method = 'POST';
const path = '/v1/order/create';
const body = { from: 'BTC', to: 'USDT', amount: 0.1 };
const timestamp = Math.floor(Date.now() / 1000);
const apiSecret = 'your_api_secret';

const signature = generateSignature(method, path, body, timestamp, apiSecret);

// Include in headers
const headers = {
  'X-API-KEY': 'your_api_key',
  'X-API-SIGN': signature,
  'X-API-TIMESTAMP': timestamp.toString(),
  'Content-Type': 'application/json'
};

import hmac
import hashlib
import json
import time

def generate_signature(method, path, body, timestamp, api_secret):
    sign_string = method + path
    if body:
        sign_string += json.dumps(body, separators=(',', ':'))
    sign_string += str(timestamp)
    
    signature = hmac.new(
        api_secret.encode('utf-8'),
        sign_string.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    return signature

# Example usage
method = 'POST'
path = '/v1/order/create'
body = {'from': 'BTC', 'to': 'USDT', 'amount': 0.1}
timestamp = int(time.time())
api_secret = 'your_api_secret'

signature = generate_signature(method, path, body, timestamp, api_secret)

# Include in headers
headers = {
    'X-API-KEY': 'your_api_key',
    'X-API-SIGN': signature,
    'X-API-TIMESTAMP': str(timestamp),
    'Content-Type': 'application/json'
}

<?php
function generateSignature($method, $path, $body, $timestamp, $apiSecret) {
    $signString = $method . $path;
    if ($body) {
        $signString .= json_encode($body, JSON_UNESCAPED_SLASHES);
    }
    $signString .= $timestamp;
    
    $signature = hash_hmac('sha256', $signString, $apiSecret);
    return $signature;
}

// Example usage
$method = 'POST';
$path = '/v1/order/create';
$body = ['from' => 'BTC', 'to' => 'USDT', 'amount' => 0.1];
$timestamp = time();
$apiSecret = 'your_api_secret';

$signature = generateSignature($method, $path, $body, $timestamp, $apiSecret);

// Include in headers
$headers = [
    'X-API-KEY: your_api_key',
    'X-API-SIGN: ' . $signature,
    'X-API-TIMESTAMP: ' . $timestamp,
    'Content-Type: application/json'
];
?>

Timestamp Validation

Timestamps are validated to prevent replay attacks. Your request timestamp must be within 5 minutes of the server's current time. Requests with timestamps outside this window will be rejected.

Security Best Practices