Signing & Pseudocode

Signature function (pseudocode)

function signRequest(apiSecret, timestamp, method, path, body):
    bodyString = body ? JSON.stringify(body) : ""
    prehash = timestamp + method.toUpperCase() + path + bodyString
    signature = Base64( HMAC_SHA256(apiSecret, prehash) )
    return signature

Usage in request

text

API-KEY: <your_api_key>
API-SIGN: <signature>
API-TIMESTAMP: <timestamp>
Content-Type: application/json

Example in code (Python style)

python

import time, hmac, hashlib, base64, json, requests

API_KEY = "your_api_key"
API_SECRET = "your_api_secret"
BASE_URL = "https://api.orangebit.com/v1"

def sign(secret, ts, method, path, body=""):
    body_str = json.dumps(body, separators=(',', ':')) if body else ""
    prehash = f"{ts}{method.upper()}{path}{body_str}"
    hmac_obj = hmac.new(secret.encode(), prehash.encode(), hashlib.sha256)
    return base64.b64encode(hmac_obj.digest()).decode()

def create_order():
    path = "/v1/orders"
    body = {
        "symbol": "BTC-USD",
        "side": "buy",
        "type": "limit",
        "price": "45000.5",
        "size": "0.001"
    }
    ts = str(int(time.time()))
    signature = sign(API_SECRET, ts, "POST", path, body)
    headers = {
        "API-KEY": API_KEY,
        "API-SIGN": signature,
        "API-TIMESTAMP": ts,
        "Content-Type": "application/json"
    }
    resp = requests.post(BASE_URL + path, headers=headers, json=body)
    print(resp.json())