Bit2Me APIFix HMAC 401
Clock, nonce window, header names, and the known-answer fixture.
HMAC uses Unix time in milliseconds (Date.now()). The documented clock-skew window is 5 seconds. Enable NTP. The fixture nonce is HMAC-only — do not send it on live requests.
No body: {nonce}:{path}. JSON body: {nonce}:{path}: plus compact JSON (JSON.stringify in JavaScript; json.dumps(..., separators=(",", ":")) in Python). Path is the request path including /v1/..., not the full URL. Do not POST {} unless you also sign {}.
SHA-256 (binary) → HMAC-SHA512 with the secret → Base64 → api-signature. Send x-api-key and x-nonce too.
Secret example_secret_do_not_use_in_production, nonce 1687155308, GET /v1/trading/wallet/balance must produce IgazRn9MPHcJjAfhrVHzI46U9iIDb7qbXYcTIN+9vrktJ6M4rET7WH+wasF+/8Thp9tzjkWaFCL8ASSzlY4D8g==. Full table: Authentication.
POST /v1/signin/apikey can return 403 invalid credentials for a bad key, a bad HMAC, or an empty JSON body {} that you did not sign. There is no sandbox host. Do not call /v1/signin/embed with an API key. Cookbook: Authentication.
Extra spaces in .env fail 401. Rotate the key if it leaked. Do not paste secrets into tickets.
Reference implementation: trading-spot-samples node/auth. bit2me-api-node-tool is discontinued.