Getting Started

To interact with our API, you need to authenticate your requests using an HMAC (Hash-based Message Authentication Code) access token. Follow these steps to get started:

1. Obtain Your Access Token:
   • Request sandbox access at https://dev.checker.finance. You will receive an API key and an API secret. The API key is public and identifies you; the API secret must never be sent in a request.
2. Include the Required Headers in Your Requests:
   • For every API request, you need to include the following headers:
     • For every API request, you need to include the following three headers:
     • x-api-key: Your API key.
     • x-nonce: A unique value for each request (for example a UUID) to prevent replay attacks.
     • x-signature: The HMAC signature described below.
3. Creating a Signature:
   • To create a signature, use the following steps:
     • Build the string ::, joined with colons.
     • is the request path only, for example /api/v1/orders. Do not include the host or the query string.
     • Sign that string with HMAC-SHA256 using your API secret as the key.
     • Base64-encode the raw digest and send it in the x-signature header.

Example in Python:

import base64, hashlib, hmac, uuid

def create_signature(api_key, nonce, path, api_secret):
    message = f"{api_key}:{nonce}:{path}"
    digest = hmac.new(api_secret.encode(), message.encode(), hashlib.sha256).digest()
    return base64.b64encode(digest).decode()

nonce = str(uuid.uuid4())
path = "/api/v1/orders"
headers = {
    "x-api-key": API_KEY,
    "x-nonce": nonce,
    "x-signature": create_signature(API_KEY, nonce, path, API_SECRET),
}

Example in bash:

PATH_TO_SIGN=/api/v1/orders
NONCE=$(uuidgen)
SIGNATURE=$(printf '%s' "$API_KEY:$NONCE:$PATH_TO_SIGN" | openssl dgst -sha256 -hmac "$API_SECRET" -binary | base64)

1. Make Your First API Call:
   • Once you have your credentials and have created the headers, you can start making API calls. Use https://api-staging.checker.finance for the sandbox and https://api.checker.finance for production. For example, to fetch all orders:

curl -X GET "https://api.checker.finance/api/v1/orders" \
-H "x-nonce: <your-nonce>" \
-H "x-api-key: <your-api-key>" \
-H "x-signature: <your-signature>"

Security Considerations

• Token Confidentiality: Keep your access token and API secret secure and do not share them publicly or in unsecured environments.
• Token Rotation: Regularly rotate your access token and API secret to maintain security. Contact our support team to assist with token rotation.

By following these steps, you will be able to securely authenticate and interact with the Checker's Orchestration Platform API, leveraging its powerful features for your trading and asset management needs.