Authentication failure within ruby gem

[matthewbretherton]

I have downloaded the ruby code btcmarkets-gem. I can access the market information through that code but get an authentication failed (error code 1 ) on private function. I am using the secret and api key as copied from the >account>api key tab on the btc web site

session log as follows

puts b.get_account_balance => "{\"success\":false,\"errorCode\":1,\"errorMessage\":\"Authentication failed.\"}"

ENV['btcm_access_key'] => "567c...c3811"

ENV['btcm_access_secret'] => "CDa6....QnQ=="
exactly as copied from web page

Rgds matthew@bretherton.id.au

[matthewbretherton]

In the python-btcmarkets section ref https://github.com/adversary-org/python-btcmarkets

It feel like, Ben McGinnes has written

" Anonymous connections (i.e. the tickers) work without any real issues. API calls requiring authentication presently do not work as the current API expects POST requests to list variables in an explicit order, whereas Python does not assign an explicit order when constructing a POST URL from dict/JSON data. This adversely affects the output of the digital signature on the authentication request and subsequently causes the authentication step to fail. “

I feel that this may also explain my issues in getting the ruby modules to work

Is this comment still appropriate and relevant for the BTC markets API

Is this order documented ?

If its adequately documented can you please supply a link or reference to that documentation

If it is not documented this order be documented?
I feel the most appropriate place is in the BTC markets authentication section

The error message is not uninformative. I appreciate that it is best practices to supply minimal information on authentication and this is to frustrate brute force attacks. However this also makes initial development more difficult and means the documentation and examples become more important

Matthew

[justin-ngin]

Hi @matthewbretherton ,

In the current iteration of the API, the order of variables in the POST request body must match exactly the order documented in the sample requests provided on the various wiki pages. I understand that some languages will not necessarily construct POST request data in an order that the user specifies. To get around this, I'd suggest creating the object first with the variables in the correct order, and then turning it into a string. Use that string in both your signature and the body of the POST request. If your chosen language does not allow for this approach either, then you will have to manually construct a string with your desired arguments that matches the format of the example requests. Please let me know if you've tried this approach.

Regards, Justin

[matthewbretherton]

Thanks for the clarity of response Justin

I have included that in my post 121 and asked for the wiki page on authentication to be updated

Unfortunately I still cannot get the account/balance get request to work

I get Authentication failed and I cannot work it out

I have pulled the https://github.com/nolim1t/btcmarkets-gem/blob/master/lib/nl-btcmarkets.rb gem apart and looked in detail at every step on the way . . .

I am confident it is passing headers correctly as if I bastardise the nonce/timestamp I get told that the timestamp is invalid

I feel comfortable as the signature ends in an == ( with the newline removed )

Non authentication requests work

I am at a loss as to how to debug further

Any assistance appreciated Matthew