Authentication and signing

Client requests are signed with four headers, X-Api-Key, X-Timestamp, X-Nonce and X-Signature, and are accepted only from the client’s allowlisted IP addresses.

Time window

The X-Timestamp header carries the moment the request was signed, in Unix seconds. A receiver accepts a timestamp at most 30 seconds away from its own clock, earlier or later, and refuses any other with UNAUTHORIZED; keep the clocks of your servers synchronised. Each nonce is kept until its timestamp plus the same 30 seconds, so a replay inside the window is always refused.