Skip to main content
POST
Exchange connect code for API key

Authorizations

X-Signature
string
header
required

HMAC signature authentication for backend integrators.

Required Headers:

  • X-Integrator-Key: Integrator API key (format: int_...)
  • X-Signature: HMAC signature (format: sha256={hex})
  • X-Timestamp: Unix timestamp in milliseconds
  • Authorization: Bearer {user-api-key}

Signature Algorithm: HMAC-SHA256

Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}

  • timestamp: Unix timestamp in milliseconds
  • METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
  • path: Request path (e.g., /v1/transactions)
  • bodyHash: SHA256 hex digest of request body (empty string if no body)

Timestamp Tolerance: ±5 minutes (300 seconds)

Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...

X-Integrator-Key
string
header
required

Integrator API key (format: int_...) used with HMAC authentication

X-Timestamp
string
header
required

Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.

Body

code
string
required

Authorization code returned after the user approves the session.

Minimum string length: 1

Response

Response for status 200

apiKey
string
required
userId
string
required
email
string
required
grantId
string
required
tokenId
string | null
required
keyPrefix
string
required