Authentication

All /v1 endpoints require HMAC-SHA256 authentication. Every request must include three headers:

Header	Description
`COIN-KEY`	Your API key
`COIN-TS`	UTC timestamp used for signing
`COIN-SIGN`	Base64 URL-safe HMAC-SHA256 signature

Timestamp

The COIN-TS header must be a UTC timestamp in one of these formats:

YYYY-MM-DDTHH:mm:ssZ
YYYY-MM-DDTHH:mm:ss.ffffffZ

The server accepts timestamps within a ±60 second window. Keep your clock synchronized (NTP recommended).

Python

import base64
import hashlib
import hmac
from datetime import datetime, timezone

API_KEY = "your_api_key"
API_SECRET = "your_api_secret"

def sign_request(method, host, path, body="", query=""):
    ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
    parts = [method.upper(), ts, host, path]
    if query:
        parts.append(query)
    if body:
        parts.append(body)
    payload = "\n".join(parts)
    mac = hmac.new(
        API_SECRET.encode("ascii"),
        payload.encode("ascii"),
        hashlib.sha256,
    ).digest()
    signature = base64.urlsafe_b64encode(mac).decode()
    return ts, signature

ts, signature = sign_request("GET", "api.coinotc.com", "/v1/ping")

headers = {
    "COIN-KEY": API_KEY,
    "COIN-TS": ts,
    "COIN-SIGN": signature,
}

API Key	Label	Last Used