Missing subaccount header

Empty balances and parent-scoped calls when X-SUBACCOUNT-ID is omitted.

After POST /v1/account/subaccount, every end-user call needs:

X-SUBACCOUNT-ID: {userId}

If you omit it, you operate the parent. Symptoms: empty pockets, KYC status that does not match the user, withdrawals on the wrong wallet.

Store userId (UUID) in your database. Do not send a partner-internal user id.

Fix HMAC 401

Clock, nonce window, header names, and the known-answer fixture.

Too many requests

Back off inside Starter 600 / Medium 800 / Pro 1000 RPM.