CODEWITHSUNDEEP
restapi
Pablo
Pablo

Reputation: 1332

Authenticating into a REST API in parameters

I am trying to get a little bit familiar with this REST API:

https://docs.gemini.com/rest-api/#private-api-invocation

However, I am trying to figure out how they do authentication, and it seems they don't use OAuth. This is what they say:

Gemini uses API keys to allow access to private APIs. You can obtain these by logging on and creating a key in Settings/API. This will give you both an "API Key" that will serve as your user name, and an "API Secret" that you will use to sign messages.

All requests must contain a nonce, a number that will never be repeated and must increase between requests. This is to prevent an attacker who has captured a previous request from simply replaying that request. We recommend using a timestamp at millisecond or higher precision. The nonce need only be increasing with respect to the session that the message is on.

Now, I don't understand where to place my API Secret key. They don't really specify a parameter name for it. Same thing goes for the nonce. Also, does the nonce need to be randomized? And what size should the nonce be? I am not that familiar with this.

Upvotes: 2

Views: 496

Answers (1)

LW001
LW001

Reputation: 2865

As described in the docs you linked you need to base64-encode the "request", "nonce" and "order_id" for the X_GEMINI_PAYLOAD header and SHA384 that payload with the API Secret for the X-GEMINI-SIGNATURE header.

Here's an example from the site (Python):

import requests
import base64
import hmac
from hashlib import sha384

url = "https://api.gemini.com/v1/order/status"

gemini_api_key = "mykey"
gemini_api_secret = "1234abcd"

# for the purposes of this example, we've shown hand-rolled JSON - please import json and use json.dumps in your real code!
b64 = base64.b64encode("""{
    "request": "/v1/order/status",
    "nonce": 123456,

    "order_id": 18834
}
""")

signature = hmac.new("1234abcd", b64, hashlib.sha384).hexdigest()

headers = {
    'Content-Type': "text/plain",
    'Content-Length': "0",
    'X-GEMINI-APIKEY': gemini_api_key,
    'X-GEMINI-PAYLOAD': b64,
    'X-GEMINI-SIGNATURE': signature,
    'Cache-Control': "no-cache"
}

response = requests.request("POST", url, headers=headers)

print(response.text)

Upvotes: 1

Related Questions