Authenticating with HMAC

Every request is signed with your API secret using HMAC-SHA256. Never send the secret itself. Sandbox base URL: https://api-staging.checker.finance. Create your key and secret on the dashboard; the secret is shown only once. For endpoints, see the API reference.

Trading API

Send these headers on every request:

Header	Value
x-api-key	Your API key.
x-nonce	A unique value per request, such as a UUID.
x-signature	The signature below.

To build the signature:

1. Join three values with colons: {api_key}:{nonce}:{path}. The path is the request path only, without the host or query string.
2. Sign that string with HMAC-SHA256, using your API secret as the key.
3. Base64-encode the raw digest and send it as x-signature.

import base64, hashlib, hmac, uuid

nonce = str(uuid.uuid4())
message = f"{api_key}:{nonce}:{path}".encode()
signature = base64.b64encode(
    hmac.new(api_secret.encode(), message, hashlib.sha256).digest()
).decode()

Payments API

Send these headers on every request:

Header	Value
X-Api-Key	Your API key.
X-Timestamp	The current time, ISO 8601 UTC (for example 2026-10-05T14:03:00Z).
X-Nonce	A unique value per request, such as a UUID.
X-Signature	The signature below.

To build the signature:

1. Join five values with newlines: {METHOD}\n{path}\n{query}\n{X-Timestamp}\n{body}. The path excludes the query string, and the query has no leading ?. Leave empty values empty; keep their lines.
2. Sign that string with HMAC-SHA256, using your API secret as the key.
3. Hex-encode the digest and send it as X-Signature.

import hashlib, hmac

message = f"{method}\n{path}\n{query}\n{timestamp}\n".encode() + body
digest = hmac.new(api_secret.encode(), message, hashlib.sha256)
signature = digest.hexdigest()

Troubleshooting

• 401 Unauthorized: check that the key and secret belong together, the key is active, and the signed values match what you sent byte for byte.
• Payments only: make sure X-Timestamp is within a few minutes of the current time.

Full endpoint details are in the API reference.