Skip to main content
Learn how to authenticate API requests and avoid common setup issues.

​
Required headers

Include the following headers with every request, except for /v2/ping:

​
How to generate the signature

Generate the signature from the exact JSON string sent in the request body:
  1. Take the exact request body string that you are going to send.
  2. Use your secret key as the HMAC key.
  3. Compute the HMAC signature using the SHA-512 algorithm and encode the result as a lowercase hexadecimal string.
  4. Send that value in the X-Processing-Signature header.
The signature must be generated from the exact request body sent to the API. If the body changes after signing, the request will be rejected — see Common pitfalls below for what usually causes that.

​
Verify your implementation

Generate a signature for the following JSON body using AbCdEfG123456 as the secret key:
Expected result:
Once your implementation reproduces this, do a live sanity check by calling a real sandbox endpoint (e.g. List balances).

​
Common pitfalls

Most authentication errors are caused by differences between the signed body and the sent body. Check the following:
  • The JSON used for signing is identical to the JSON sent
  • Field order has not changed
  • No additional whitespace or line breaks were introduced
  • Your HTTP client did not modify the request body
  • The signature is hex-encoded (not Base64)
  • Header names match exactly:
    • X-Processing-Key
    • X-Processing-Signature
Last modified on September 16, 2026