> ## Documentation Index
> Fetch the complete documentation index at: https://docs.binibit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Public market data is anonymous. Trading and wallet endpoints require HMAC-SHA256 request signing.

## Public market data — no auth

All market data endpoints documented in [API Reference](/api-reference/introduction) are **public**. They require:

* No API key
* No HMAC signature
* No bearer token

Examples:

```bash theme={null}
curl "https://public-api.binibit.com/api/tickers?currencyPairCode=ETH_BTC"
curl "https://public-api.binibit.com/api/orderbook?currencyPairCode=TRX_USDT"
curl "https://public-api.binibit.com/api/healthcheck"
```

## Trading and wallets — HMAC-SHA256

The trading and wallet endpoints (create/cancel orders, deposits, withdrawals, balances) on `public-api.binibit.com` use HMAC-SHA256 request signing.

<Note>
  Detailed documentation for the signing flow is on the [v2.0 roadmap](/changelog#roadmap). The scheme below is the same one the Binibit web client uses today and is reproduced from the upstream OpenAPI spec at [`/swagger/`](https://public-api.binibit.com/swagger/).
</Note>

### Signing scheme

1. Generate an API key pair (`publicKey`, `privateKey`) at [binibit.com/apikeys](https://binibit.com/apikeys).
2. Build the canonical signature text:

   ```
   signatureText = publicKey + requestUrl + requestBodyString
   ```

   * `publicKey` — your API public key, e.g. `b2H9TlfRu6MOgG4m9wvrf9maSUiPsQJEui0JrB`
   * `requestUrl` — full URL of the request, e.g. `https://public-api.binibit.com/api/orders`
   * `requestBodyString` — the JSON body as a single-line string for `POST`/`PUT`, or empty string for `GET`/`DELETE`. Example: `{"isBid":true,"currencyPairCode":"ETH_BTC","amount":0.01,"price":0.02}`
3. Compute the HMAC-SHA256 over UTF-8 bytes of `signatureText` using `privateKey` as the key.
4. Encode the resulting digest as a lowercase hex string.
5. Send it in the `API-Signature` header along with `API-PublicKey`.

### JavaScript

```javascript theme={null}
import CryptoJS from "crypto-js";

const publicKey = "b2H9...";
const privateKey = "..."; // never log or expose

const url = "https://public-api.binibit.com/api/orders";
const body = JSON.stringify({
  isBid: true,
  currencyPairCode: "ETH_BTC",
  amount: 0.01,
  price: 0.02,
});

const signatureText = publicKey + url + body;
const signature = CryptoJS.enc.Hex.stringify(
  CryptoJS.HmacSHA256(signatureText, privateKey)
);

await fetch(url, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "API-PublicKey": publicKey,
    "API-Signature": signature,
  },
  body,
});
```

### C\#

```csharp theme={null}
using System.Security.Cryptography;
using System.Text;

string publicKey  = "b2H9...";
string privateKey = "...";
string requestUrl = "https://public-api.binibit.com/api/orders";
string body = "{\"isBid\":true,\"currencyPairCode\":\"ETH_BTC\",\"amount\":0.01,\"price\":0.02}";

string signature = new HMACSHA256(Encoding.UTF8.GetBytes(privateKey))
    .ComputeHash(Encoding.UTF8.GetBytes(publicKey + requestUrl + body))
    .Aggregate(new StringBuilder(), (sb, b) => sb.AppendFormat("{0:x2}", b))
    .ToString();
```

A signature looks like:

```
b7238692e0537d3a7fd13faff266d315e3185247e1644c1155f60e6d4e4e445d
```

### Things to watch

* **No separators between the three parts** of `signatureText`. They are concatenated verbatim.
* **Body string must match exactly** the bytes you transmit. Reformatting (different key order, whitespace) breaks the signature.
* **Server clock skew** can cause auth failures if the server enforces a timestamp window — see the planned `GET /api/time` endpoint on the [roadmap](/changelog#roadmap).