Authentication
Signing REST requests with HMAC-SHA512, and the exact message the signature is computed over.
Every REST request is signed with HMAC-SHA512. The signature travels; the secret does not, so a request can be verified without the secret ever crossing the network.
What gets signed
The signed message is the request path and the JSON body, joined by a null byte:
path + "\0" + body
Three details account for most integration failures:
- The separator is a null byte (
\0), not a space or a newline. - The secret is base64-decoded before use as the HMAC key. Signing with the raw string produces a well-formed signature that always fails verification.
- The signature is computed over the body exactly as sent. Serialise once, sign that string, and transmit the same bytes — re-serialising afterwards can reorder keys and invalidate the signature.
tonce
The body carries a tonce: the current Unix time in microseconds. Because
it is part of the body, it must be added before signing.
Milliseconds are the usual mistake here, and they are rejected.
Headers
Rest-Key: <your API key>
Rest-Sign: <the signature>
Content-Type: application/json
Never paste a production secret into an online compiler, a shared notebook or a
scratch environment. Generate signatures where you control the machine.