Skip to main content

Public market data — no auth

All market data endpoints documented in API Reference are public. They require:
  • No API key
  • No HMAC signature
  • No bearer token
Examples:

Trading and wallets — HMAC-SHA256

The trading and wallet endpoints (create/cancel orders, deposits, withdrawals, balances) on public-api.binibit.com use HMAC-SHA256 request signing.
Detailed documentation for the signing flow is on the v2.0 roadmap. The scheme below is the same one the Binibit web client uses today and is reproduced from the upstream OpenAPI spec at /swagger/.

Signing scheme

  1. Generate an API key pair (publicKey, privateKey) at binibit.com/apikeys.
  2. Build the canonical signature text:
    • publicKey — your API public key, e.g. b2H9TlfRu6MOgG4m9wvrf9maSUiPsQJEui0JrB
    • requestUrl — full URL of the request, e.g. https://public-api.binibit.com/api/orders
    • requestBodyString — the JSON body as a single-line string for POST/PUT, or empty string for GET/DELETE. Example: {"isBid":true,"currencyPairCode":"ETH_BTC","amount":0.01,"price":0.02}
  3. Compute the HMAC-SHA256 over UTF-8 bytes of signatureText using privateKey as the key.
  4. Encode the resulting digest as a lowercase hex string.
  5. Send it in the API-Signature header along with API-PublicKey.

JavaScript

C#

A signature looks like:

Things to watch

  • No separators between the three parts of signatureText. They are concatenated verbatim.
  • Body string must match exactly the bytes you transmit. Reformatting (different key order, whitespace) breaks the signature.
  • Server clock skew can cause auth failures if the server enforces a timestamp window — see the planned GET /api/time endpoint on the roadmap.