BtcTurk Authentication: API Key and Signature (2026)

Authentication overview

BtcTurk employs an API key and signature-based authentication mechanism to secure interactions with its platform. This approach ensures that only authorized applications can access private user data and execute trading operations. Public endpoints, which provide general market data, may require only an API key for rate limiting and identification, while private endpoints, used for account management and trading, mandate a cryptographic signature to verify the request's authenticity and integrity.

The core principle behind BtcTurk's authentication is to prove both the client's identity and that the request has not been tampered with in transit. This is achieved by combining a public API key, a private secret key, and a nonce (a number used once) to generate a unique signature for each request. This method is common in cryptocurrency exchanges to mitigate risks associated with replay attacks and unauthorized access, aligning with best practices for securing financial APIs HMAC-SHA256 authentication overview.

Developers interacting with the BtcTurk API will typically generate their credentials through their BtcTurk account settings. These credentials, consisting of an API Key and an API Secret, are then used to construct the necessary headers for authenticated requests. The BtcTurk API documentation provides detailed instructions and examples for various programming languages, including Python, Java, C#, Node.js, and Go, to assist developers in correctly implementing the authentication flow BtcTurk API documentation.

Supported authentication methods

BtcTurk primarily supports an API Key and Signature-based authentication method. This mechanism is designed to provide secure access to both public market data and private user-specific endpoints.

API Key and Secret Key

Every authenticated request to the BtcTurk API requires an API Key and a corresponding API Secret Key. The API Key acts as a public identifier for your application, while the API Secret Key is a private credential used to generate a unique signature for each request. This two-part system is fundamental to verifying the origin and integrity of API calls.

HMAC-SHA256 Signature

For private endpoints, BtcTurk mandates the use of an HMAC-SHA256 signature. This signature is generated using your API Secret Key, a nonce, and the request payload. The server then uses its copy of your API Secret Key to independently verify the signature. If the signatures match, the request is deemed authentic and untampered. This cryptographic signing process is a standard security measure for protecting sensitive API operations RFC 2104 for HMAC.

Nonce (Number Used Once)

A nonce is a unique, monotonically increasing number included in each signed request. Its primary purpose is to prevent replay attacks, where an attacker might intercept a valid request and resend it to the server. By requiring a new nonce for every request, the server can detect and reject duplicate or out-of-order requests.

The following table summarizes BtcTurk's supported authentication methods:

Getting your credentials

To interact with the BtcTurk API, you first need to generate your API credentials from your BtcTurk account. These credentials consist of an API Key and an API Secret Key.

1. Log in to your BtcTurk Account: Navigate to the official BtcTurk website and log in with your username and password BtcTurk homepage.
2. Access API Settings: Once logged in, go to your 'Profile' or 'Account Settings' section. Look for a sub-section typically labeled 'API Settings', 'API Management', or 'API Keys'. The exact path may vary slightly but is generally found within security or developer settings.
3. Generate New API Key: Within the API settings, you will find an option to 'Create New API Key' or 'Generate API Credentials'. Click on this to initiate the process.
4. Configure Permissions (if applicable): Some platforms allow you to set specific permissions for your API key (e.g., read-only access, trade execution, withdrawal permissions). For BtcTurk, you may be able to define the scope of the key. It is a security best practice to grant only the minimum necessary permissions for your application's function.
5. Record API Key and Secret Key: After generating, the system will display your API Key and, crucially, your API Secret Key. The API Secret Key is usually shown only once immediately after generation. It is imperative that you copy and store both of these securely immediately. If you lose your API Secret Key, you will typically need to revoke the existing key and generate a new one, as it cannot be retrieved.
6. Enable Two-Factor Authentication (2FA): Before generating API keys, ensure that Two-Factor Authentication (2FA) is enabled on your BtcTurk account. This adds an extra layer of security to your account, protecting your API keys even if your primary login credentials are compromised.

Once you have obtained your API Key and Secret Key, you are ready to integrate them into your application for making authenticated requests to the BtcTurk API.

Authenticated request example

This Python example demonstrates how to construct a signed request for a private endpoint on BtcTurk. This typical use case involves fetching account balance information, requiring an API Key, API Secret, and an HMAC-SHA256 signature.

import hmac
import hashlib
import base64
import time
import requests

# --- Replace with your actual API Key and Secret ---
API_KEY = "YOUR_BTCTURK_API_KEY"
API_SECRET = "YOUR_BTCTURK_API_SECRET"

# Base URL for BtcTurk API
BASE_URL = "https://api.btcturk.com/api/v2"

def get_signed_headers(method, url_path, nonce, body_data=None):
    # Prepare message for signing
    # The message format for BtcTurk is typically Nonce + Request Path + Body (if POST/PUT)
    # For GET requests, body_data is usually empty or not part of the signature string.

    # Note: BtcTurk's specific signature string composition should be verified 
    # against their latest documentation. This example assumes Nonce + URL Path.
    # Some exchanges include the entire request body for POST/PUT requests.
    
    # For simplicity, we'll use Nonce + URL Path as per common practices for GET requests.
    message = f"{nonce}{url_path}"
    
    # If there's a body (e.g., for POST requests), it might need to be included
    # in the message for signing. Check BtcTurk docs for exact requirements.
    if body_data and method != 'GET':
        message += body_data # Assuming body_data is already a string

    # Decode the API_SECRET from base64 if it's provided in that format by BtcTurk
    # Often, API secrets are plain strings, but some platforms base64-encode them.
    # Assume plain string for now, but be aware of this potential difference.
    decoded_secret = base64.b64decode(API_SECRET) if isinstance(API_SECRET, str) else API_SECRET

    # Generate HMAC-SHA256 signature
    signature = hmac.new(decoded_secret, message.encode('utf-8'), hashlib.sha256).digest()
    encoded_signature = base64.b64encode(signature).decode('utf-8')

    headers = {
        "X-BTCTURK-APIKEY": API_KEY,
        "X-BTCTURK-NONCE": str(nonce),
        "X-BTCTURK-SIGNATURE": encoded_signature,
        "Content-Type": "application/json" # Important for POST/PUT requests
    }
    return headers

def get_account_balance():
    url_path = "/users/balances"
    full_url = f"{BASE_URL}{url_path}"
    nonce = int(time.time() * 1000) # Millisecond timestamp as nonce

    headers = get_signed_headers("GET", url_path, nonce)
    response = requests.get(full_url, headers=headers)

    if response.status_code == 200:
        print("Account Balances:")
        print(response.json())
    else:
        print(f"Error fetching balances: {response.status_code} - {response.text}")

if __name__ == "__main__":
    # Ensure you've replaced API_KEY and API_SECRET with your actual credentials
    if API_KEY == "YOUR_BTCTURK_API_KEY" or API_SECRET == "YOUR_BTCTURK_API_SECRET":
        print("Please replace 'YOUR_BTCTURK_API_KEY' and 'YOUR_BTCTURK_API_SECRET' with your actual credentials.")
    else:
        get_account_balance()

This example demonstrates the essential components: generating a nonce, constructing the message string for signing, creating the HMAC-SHA256 signature using the secret key, and then adding these to the request headers along with the API key. Always refer to the official BtcTurk API documentation for the most current and precise details on signature generation, especially regarding the exact composition of the message string for different HTTP methods BtcTurk API reference.

Security best practices

Implementing security best practices is crucial when working with API keys and secrets, especially for financial platforms like BtcTurk. Adhering to these guidelines helps protect your account from unauthorized access and potential financial losses.

• Never Hardcode API Keys: Avoid embedding your API Key and Secret directly in your source code. Instead, use environment variables, configuration files, or secure key management services to store and retrieve them. This prevents exposure if your code repository is compromised.
• Restrict API Key Permissions (Least Privilege): When generating API keys in your BtcTurk account, grant only the minimum necessary permissions. For example, if your application only needs to read market data, do not enable trading or withdrawal permissions for that key. This limits the damage an attacker can do if a key is compromised.
• Rotate API Keys Regularly: Periodically revoke old API keys and generate new ones. While BtcTurk allows user-managed key rotation, a common practice is to rotate keys every 90 days. This minimizes the window of opportunity for a compromised key to be exploited.
• Secure Your Development Environment: Ensure that your development machine and servers where your application runs are secure. Use strong, unique passwords, enable 2FA on all relevant accounts, keep operating systems and software updated, and use firewalls.
• Use HTTPS for All API Calls: Always make API requests over HTTPS. This encrypts the communication between your application and BtcTurk's servers, protecting against eavesdropping and man-in-the-middle attacks. BtcTurk's API endpoints are designed to be accessed via HTTPS, which is a standard for secure web communication Mozilla's HTTPS definition.
• Implement Robust Error Handling and Logging: Log authentication failures and suspicious activities, but avoid logging sensitive information like API secrets. Monitor these logs for unusual patterns that might indicate an attempted breach.
• Validate Nonce Uniqueness and Monotonicity: When implementing the client-side nonce generation, ensure it is truly unique and strictly increasing for each request. Using a millisecond timestamp is a common and effective method for this.
• Protect API Secret Key: Treat your API Secret Key with the same level of security as your account password. Never share it, commit it to public repositories, or send it unencrypted over any channel.
• Enable Two-Factor Authentication (2FA) on Your BtcTurk Account: This is a fundamental security measure. Even if your login credentials are stolen, 2FA prevents unauthorized access to your account and API key generation portal.