Authentication

Signed endpoints (TRADE and USER_DATA) prove two things: that the request comes from you, and that it has not been tampered with in transit. You provide the first with your API key header and the second with an HMAC signature.

The API key header

Send your API key on every API_KEY, TRADE and USER_DATA request:

X-SDX-APIKEY: your-api-key

Signing a request

For signed endpoints, add two parameters and compute a signature:

The signature is the hex HMAC SHA256 of the total query string (for GET/DELETE) or the request body (for POST), using your secret key as the HMAC key. Append it as the last signature parameter; it is never itself part of the signed payload.

Worked example

Suppose you place an order with this payload:

symbol=BTCUSDT&side=BUY&type=LIMIT&quantity=0.01&price=64000&timeInForce=GTC&timestamp=1717430400000

Compute the signature and send it. The example uses the command line, but any HMAC SHA256 library works the same way.

SECRET="your-secret-key"
PAYLOAD="symbol=BTCUSDT&side=BUY&type=LIMIT&quantity=0.01&price=64000&timeInForce=GTC&timestamp=1717430400000"
SIG=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -X POST -H "X-SDX-APIKEY: your-api-key" \
  "https://api.spacedex.com/api/v1/order" \
  -d "$PAYLOAD&signature=$SIG"

The receive window

SPACEDEX rejects a signed request if timestamp is more than recvWindow milliseconds behind server time, or ahead of server time by more than one second. This limits how long an intercepted request can be replayed.

if (serverTime - timestamp) > recvWindow  -> rejected
if timestamp > (serverTime + 1000)        -> rejected