search

BitMEX / api-connectors

Libraries for connecting to the BitMEX API.
https://www.bitmex.com/app/restAPI
910 stars 795 forks source link

Authentication Issue #212

Open david-d-white opened 6 years ago

david-d-white commented 6 years ago

I was struggling for a while with receiving constant "Signature is not valid" errors when trying to send signed HTTP GET and DELETE methods that had parameters, however when sending requests with no parameters, I received no issues. Furthermore when sending HTTP POST requests the identical signing method worked perfectly.

After looking through the examples on the website, I noticed that as opposed to the stated calculation method : hex(HMAC_SHA256(apiSecret, verb + path + expires + data)), they were in fact calculating hex(HMAC_SHA256(apiSecret, verb + path + data + expires )). I managed to solve the problem by switching the data and expires before encoding, however this seems like a very weird issue so I thought I would bring attention to it in case it is a bug/ in case anyone else is struggling with a similar issue.

denigada commented 6 years ago

I changed the order but still getting Signature is not valid error :(

quangtho2910 commented 6 years ago

I got the same problem when using c# example. Tried to get wallet information but didn't work!

leogi222 commented 6 years ago

Are you saying that you send in the data request the verb + path + expires + data and you are signing verb + path + data + expires? I'm curious because i can't get past that signature error. Is the data supposed to be only the JSON order itself or the full thing that is being signed?

david-d-white commented 6 years ago

It's hard to explain, but reading through the code on their example page:, you will see how the signature is calculated differently. https://testnet.bitmex.com/app/apiKeysUsage. The way I got it to work is by signing (verp + path + data + expires) but only for GET and DELETE requests. (POST requests seem to be signed as (verb + path + expires + data)).

ryanfox commented 6 years ago

The python REST client uses verb + path + expires + data, as described here.

Using that client, I get no errors for authenticated GET, POST, and DELETE requests, both with and without parameters. Is there a reproducible case that can replicate this issue?