Your API key, sent in the api-key request header.

Lowercase hex-encoded HMAC-SHA256 of the timestamp header value, using your API secret as the key: hex(HMAC_SHA256(api_secret, timestamp)). Only the timestamp is signed; the request path and body are not part of the signature. An invalid signature returns HTTP 401.

A Unix timestamp in seconds, sent with every request and used as the signed message. Your timestamp must be within 30 seconds of the API server time, otherwise the request is considered expired and rejected with HTTP 408. We recommend using the Get Time endpoint to query the API server time if you believe there is a time difference between your server and the API servers.