Get your API keys
Get a public/private HMAC pair from Settings → API keys, or (coming soon) derive the same pair by signing with your wallet. Full steps and the wallet-derive payload are in Get your API keys.- Public key — included in every request as the
Keyheader. Safe to log. - Private key — used to sign requests. Never share or log this value.
On-chain CLOB trading is coming soon. HMAC still authenticates every HTTP request. When settlement moves on-chain, each create will also need an EIP-712
LimitOrderIntent signed by your Safe owner key. HMAC never replaces that wallet signature. See On-chain trading.Required headers
Every authenticated request must include these three headers:Signing process
1
Collect parameters to sign
Gather all request parameters — query string parameters for GET requests, body parameters for POST requests — plus
Key (your public key) and Timestamp (current Unix timestamp as an integer).2
Sort by key name (case-sensitive)
Sort all parameters (including
Key and Timestamp) by key using a case-sensitive code-point sort — the same order Python’s sorted() produces. Uppercase letters (A–Z) come before lowercase letters (a–z), so Key and Timestamp sort before category. Do not use a case-insensitive or locale-aware comparator (for example JavaScript localeCompare) — the server rejects those signatures with 401 authentication_failed.3
URL-encode the sorted parameters
Join the sorted key-value pairs as a URL-encoded query string, for example:
4
Sign with your private key
Compute an HMAC-SHA512 digest using your private key as the secret and the URL-encoded string as the message. Use the hex digest (not base64).
5
Add headers to your request
Include
Key, Timestamp, and HMAC as request headers. Do not include the parameters again in the query string separately — they are already encoded in the signature.Code examples
GET vs. POST requests
- GET requests: include all query string parameters in the parameter set you sign (in addition to
KeyandTimestamp). - POST requests: include all body parameters in the parameter set you sign. Do not mix query and body parameters.