Skip to main content

Auth

You can generate API-keys in you account settings.

For each request you will need API-Signature:

  1. Calculate signatureText = publicKey + requestUrl + requestBodyString (no separator symbols in-between)
  • publicKey - example: b2H9TlfRu6MOgG4m9wvrf9maSUiPsQJEui0JrB
  • requestUrl - full url of request, example: https://data.azbit.com/api/orders
  • requestBodyString - json request body as a 1-line string, example: {"isBid":true,"currencyPairCode":"ETH_BTC","amount":0.01,"price":0.02}. For GET methods it will be an empty string.
  • signatureText = b2H9TlfRu6MOgG4m9wvrf9maSUiPsQJEui0JrBhttps://data.azbit.com/api/orders{"isBid":true,"currencyPairCode":"ETH_BTC","amount":0.01,"price":0.02}
  • signatureText for GET method = b2H9TlfRu6MOgG4m9wvrf9maSUiPsQJEui0JrBhttps://data.azbit.com/api/orders

  1. Convert signatureText as UTF8-string to bytes

  2. Compute HMACSHA256 hash from signatureText-bytes

  3. Convert hash-bytes to HEX-string

Example in JS code:

 <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/crypto-js.min.js"></script>

 let signature = CryptoJS.enc.Hex.stringify(CryptoJS.HmacSHA256(publicKey + requestUrl + requestBodyString, privateKey));

Example in C# code:

 string signature = new HMACSHA256(Encoding.UTF8.GetBytes(privateKey))
     .ComputeHash(Encoding.UTF8.GetBytes(publicKey + requestUrl + requestBodyString))
     .Aggregate(new StringBuilder(), (sb, b) => sb.AppendFormat("{0:x2}", b), (sb) => sb.ToString());

API-Signature should look like this: b7238692e0537d3a7fd13faff266d315e3185247e1644c1155f60e6d4e4e445d

  1. Add headers to each request: "API-Signature" - your signature "API-PublicKey" - your public key

A User-Agent header is required​

Requests are served through Cloudflare, which refuses a request that sends no User-Agent with 403 and a body reading error code: 1010. That is not an authentication or signature failure — it never reaches the exchange. Send any non-empty User-Agent (identifying your bot is helpful when we have to look a request up).

Checking what a key can do​

GET /api/user/api-keys/current reports the permissions of the key making the request, so you never have to attempt a withdrawal to find out whether the key is allowed one:

{
  "publicKey": "b2H9TlfRu6MOgG4m9wvrf9maSUiPsQJEui0JrB",
  "userId": "0f5c...",
  "description": "market maker",
  "dateCreated": "2026-08-01T10:00:00+00:00",
  "canTrade": true,
  "canReadUserInfo": true,
  "canWithdraw": false,
  "ipWhitelist": ["203.0.113.10"]
}

Each permission is set per key in account settings — withdrawal can be switched off for one key while another keeps it. An empty ipWhitelist means the key may be used from anywhere; when it is not empty, a request from any other address is refused with 403.

GET /api/user/profile returns just { "userId": "..." }, for clients that need their account id before they have placed any order.