Skip to main content
Every request to the Futuur API must be authenticated. Authentication uses HMAC-SHA512 signatures generated from your public/private key pair. There are no bearer tokens or session cookies — each request is independently signed.

Get your API keys

Get a public/private HMAC pair from SettingsAPI keys, or (coming soon) derive the same pair by signing with your wallet. Full steps and the wallet-derive payload are in Get your API keys.
  • Public key — included in every request as the Key header. Safe to log.
  • Private key — used to sign requests. Never share or log this value.
On-chain CLOB trading is coming soon. HMAC still authenticates every HTTP request. When settlement moves on-chain, each create will also need an EIP-712 LimitOrderIntent signed by your Safe owner key. HMAC never replaces that wallet signature. See On-chain trading.

Required headers

Every authenticated request must include these three headers:

Signing process

1

Collect parameters to sign

Gather all request parameters — query string parameters for GET requests, body parameters for POST requests — plus Key (your public key) and Timestamp (current Unix timestamp as an integer).
2

Sort by key name (case-sensitive)

Sort all parameters (including Key and Timestamp) by key using a case-sensitive code-point sort — the same order Python’s sorted() produces. Uppercase letters (AZ) come before lowercase letters (az), so Key and Timestamp sort before category. Do not use a case-insensitive or locale-aware comparator (for example JavaScript localeCompare) — the server rejects those signatures with 401 authentication_failed.
3

URL-encode the sorted parameters

Join the sorted key-value pairs as a URL-encoded query string, for example:
4

Sign with your private key

Compute an HMAC-SHA512 digest using your private key as the secret and the URL-encoded string as the message. Use the hex digest (not base64).
5

Add headers to your request

Include Key, Timestamp, and HMAC as request headers. Do not include the parameters again in the query string separately — they are already encoded in the signature.

Code examples

GET vs. POST requests

  • GET requests: include all query string parameters in the parameter set you sign (in addition to Key and Timestamp).
  • POST requests: include all body parameters in the parameter set you sign. Do not mix query and body parameters.
If your GET request has no additional parameters (e.g., GET /me/), you still sign just Key and Timestamp.

Common errors

Never include your private key in client-side code or commit it to version control. Treat it with the same care as a password.