Authentication and signing

Choose the right authentication

READ access authorizes account reads and Listen Key lifecycle operations. Trading actions also require TRADE permission. An API Credential cannot sign you in to the website or perform funding and account administration.

Sign the raw parameters

Query-only requests are the simplest portable approach, including for signed GET requests. When parameters are split across query and body, query values win. The first duplicate in each location wins. Values are not percent-decoded, and JSON request bodies are not supported.

Run signing code in your own trusted client. A key header alone does not sign a request. The examples below use environment variables and never need a secret entered into this website.

• Build the query string and, if used, the raw form body. Decimal amounts remain strings.
• Concatenate the raw query bytes followed by the raw body bytes. Do not insert an ampersand between those two parts.
• Calculate HMAC-SHA256 with your secret and encode the result as hexadecimal.
• Append signature as the final parameter of the query or body, then send the exact bytes you signed.

import hashlib
import hmac
import json
import os
import time
from urllib.request import Request, urlopen

key = os.environ["MARIEX_API_KEY"]
secret = os.environ["MARIEX_API_SECRET"]
query = f"timestamp={int(time.time() * 1000)}&recvWindow=5000"
signature = hmac.new(
    secret.encode(), query.encode(), hashlib.sha256
).hexdigest()
url = f"https://paper.mariex.com/fapi/v2/balance?{query}&signature={signature}"
request = Request(url, headers={"X-MBX-APIKEY": key})
with urlopen(request, timeout=10) as response:
    print(json.load(response))

Keep the clock in sync

timestamp is your request's Unix time in milliseconds. recvWindow defaults to 5000 milliseconds and accepts positive integers up to 60000.

The timestamp must be less than server time plus 1000 milliseconds, and the request must be no older than recvWindow. Use the server-time endpoint to check your clock offset. A signature failure returns -1022; a timestamp-window failure returns -1021.

Manage access in the website

Create, edit or revoke API Credentials from the selected Trading Account's API credentials page. Use separate credentials for clients that need different permissions or source policies.

Revocation ends the credential's programmatic access and its Listen Key authority. Website Application Sessions are separate. After a material credential-policy change, obtain a Listen Key again, reconnect and refresh current account state.