CryptoMarket Getting Started: API Keys and First Request (2026)

Getting started overview

Integrating with the CryptoMarket API involves a series of steps designed to secure your access and enable programmatic interaction with the exchange's services. This guide focuses on the initial configuration required to make your first authenticated API call. The process begins with account creation, followed by the generation of API keys and secrets, which are crucial for signing requests. Understanding the authentication mechanism, specifically HMAC signatures, is fundamental before attempting to retrieve market data or execute trades. CryptoMarket provides API documentation that details available endpoints for market data, trading, and account management, which developers can consult for comprehensive endpoint specifics.

Before proceeding, ensure you have access to a development environment where you can execute HTTP requests, such as a command-line tool like curl or a programming language with HTTP client libraries. Familiarity with JSON data format is also beneficial, as CryptoMarket's API primarily communicates using JSON payloads. The initial setup is critical for establishing a secure and functional connection to the CryptoMarket platform.

Quick reference table

Create an account and get keys

Accessing the CryptoMarket API requires an active user account. If you do not already have one, navigate to the CryptoMarket website and complete the registration process. This typically involves providing an email address, setting a password, and potentially completing identity verification (KYC – Know Your Customer) requirements, which are standard for cryptocurrency exchanges to comply with financial regulations. The extent of verification may vary based on your region and desired trading limits.

Once your account is set up and verified, you can proceed to generate your API keys. These keys consist of two primary components: an API Key (sometimes referred to as a public key) and an API Secret (a private key). The API Key identifies your application, while the API Secret is used to sign your requests, proving their authenticity and ensuring they originate from your account.

Steps to generate API keys:

1. Log in to your CryptoMarket account: Use your registered credentials to access your user dashboard.
2. Navigate to API Settings: Look for a section labeled 'API Keys', 'API Management', or similar, usually found within your profile or security settings. The exact path may vary slightly based on UI updates.
3. Create New API Key: Select the option to generate a new API key. You may be prompted to provide a label for the key (e.g., 'My Trading Bot') and define permissions (e.g., 'Read-only', 'Trade', 'Withdrawal'). For your first request, 'Read-only' access is sufficient and recommended for security.
4. Record API Key and Secret: Upon creation, the platform will display your API Key and API Secret. It is critical to copy these values immediately and store them securely. The API Secret is often displayed only once and cannot be retrieved if lost. Treat your API Secret like a password; do not embed it directly into client-side code or commit it to public repositories.

For enhanced security, consider enabling Two-Factor Authentication (2FA) on your CryptoMarket account if you haven't already. While not directly related to API key generation, 2FA adds an extra layer of protection to your account, mitigating risks associated with unauthorized access.

Your first request

After obtaining your API Key and Secret, the next step is to make an authenticated request to the CryptoMarket API. CryptoMarket uses HMAC-SHA256 for signing API requests, a common method for securing RESTful APIs. An HMAC signature ensures that the request has not been tampered with and originates from an authorized source. The signature is generated using your API Secret and specific components of the request.

Authentication details

Each authenticated request to CryptoMarket's API requires the following headers:

• X-CM-APIKEY: Your API Key.
• X-CM-TIMESTAMP: The current Unix timestamp in milliseconds. This value is used in the signature.
• X-CM-SIGNATURE: The HMAC-SHA256 signature of the request.

Signature generation

The signature string is constructed by concatenating specific request elements in a defined order and then hashing them with your API Secret. The exact string to sign typically follows this pattern:

timestamp + HTTP_METHOD + request_path + body_hash

• timestamp: The value of X-CM-TIMESTAMP.
• HTTP_METHOD: The HTTP method in uppercase (e.g., GET, POST).
• request_path: The path component of the URL, including query parameters, e.g., /api/v1/spot/public/symbols?currency=BTC.
• body_hash: The SHA256 hash of the request body. If the request has no body (e.g., for GET requests), an empty string's hash (e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) is used.

The entire concatenated string is then signed using HMAC-SHA256 with your API Secret as the key. The resulting hash should be converted to a hexadecimal string.

Example GET request (unauthenticated)

While authentication is required for most useful endpoints, you can test basic connectivity with a public endpoint first. For instance, retrieving a list of supported symbols does not require authentication:

curl -X GET "https://api.cryptomarket.com/api/v1/spot/public/symbols"

This command should return a JSON array of trading pairs and their properties. If this works, your network connectivity to the API is established.

Example authenticated GET request

Let's construct an authenticated request to get account balances. This requires X-CM-APIKEY, X-CM-TIMESTAMP, and X-CM-SIGNATURE.

Assume:

• API Key: YOUR_API_KEY
• API Secret: YOUR_API_SECRET
• Timestamp: 1678886400000 (example in milliseconds)
• HTTP Method: GET
• Request Path: /api/v1/spot/private/balances
• Body Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (for empty body)

The string to sign would be:

1678886400000GET/api/v1/spot/private/balancese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Generate the HMAC-SHA256 signature of this string using YOUR_API_SECRET. Let's say the resulting signature (after hex encoding) is YOUR_GENERATED_SIGNATURE.

Then, the curl command would look like this:

TIMESTAMP=$(($(date +%s%N)/1000000))
METHOD="GET"
PATH="/api/v1/spot/private/balances"
BODY_HASH="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
STRING_TO_SIGN="${TIMESTAMP}${METHOD}${PATH}${BODY_HASH}"

# Replace YOUR_API_SECRET with your actual secret
SIGNATURE=$(echo -n "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "YOUR_API_SECRET" | awk '{print $NF}')

curl -X GET \
  -H "X-CM-APIKEY: YOUR_API_KEY" \
  -H "X-CM-TIMESTAMP: ${TIMESTAMP}" \
  -H "X-CM-SIGNATURE: ${SIGNATURE}" \
  "https://api.cryptomarket.com/api/v1/spot/private/balances"

Replace YOUR_API_KEY and YOUR_API_SECRET with your actual credentials. This command constructs the timestamp, generates the signature using openssl (a common utility for cryptographic operations), and then executes the curl request with the necessary headers. A successful response will return a JSON object containing your account balances.

Common next steps

Once you've successfully made your first authenticated request to CryptoMarket, several common next steps can further your integration:

• Explore Market Data Endpoints: Access real-time and historical market data for various trading pairs. Endpoints like /api/v1/spot/public/candles or /api/v1/spot/public/trades can provide candlestick data and recent trades, which are essential for market analysis and algorithmic trading strategies.
• Implement Trading Functionality: Move beyond read-only access by implementing order placement (e.g., /api/v1/spot/private/order), order cancellation, and querying open orders. This requires granting appropriate 'Trade' permissions to your API keys.
• Manage Account Information: Develop features to retrieve detailed account information, transaction history, and deposit/withdrawal addresses. These endpoints are crucial for building comprehensive portfolio management tools.
• Error Handling: Integrate robust error handling into your application. The API documentation specifies common error codes and messages, allowing your application to gracefully manage issues like invalid signatures, rate limits, or insufficient funds.
• Secure API Key Storage: Implement best practices for storing your API keys securely. Avoid hardcoding them directly into your application. Instead, use environment variables, secure configuration files, or dedicated secret management services.
• Rate Limit Management: Be aware of CryptoMarket's API rate limits. Implement exponential backoff or other strategies to manage requests and prevent your application from being temporarily blocked due to excessive calls.

Troubleshooting the first call

Encountering issues during your first API call is common. Here are some troubleshooting steps:

• Signature Mismatch: This is the most frequent issue. Double-check the string you are signing. Ensure the timestamp, HTTP method, request path, and body hash are concatenated correctly and in the precise order specified in the CryptoMarket API documentation. Verify that the correct API Secret is used for HMAC-SHA256 generation.
• Timestamp Skew: Ensure your system's clock is synchronized with a reliable time source. A significant difference between your local timestamp and the server's timestamp can cause signature validation failures. Use NTP (Network Time Protocol) to keep your system's clock accurate.
• Incorrect HTTP Method: Verify that the HTTP method (GET, POST, PUT, DELETE) used in your request matches the method expected by the endpoint and the one included in your signature string.
• API Key Permissions: Confirm that the API key you are using has the necessary permissions for the endpoint you are trying to access. For instance, a 'Read-only' key cannot execute trades. Adjust permissions in your CryptoMarket account settings if needed.
• Invalid Request Path or Parameters: Check for typos in the URL path or incorrect query parameters. Refer to the CryptoMarket API reference for exact endpoint paths and required parameters.
• Network Connectivity: Ensure your development environment has unrestricted outbound access to api.cryptomarket.com. Firewalls or proxy servers can sometimes block API requests.
• Body Hash for POST/PUT: If you are making a POST or PUT request, ensure the request body is correctly JSON-encoded and its SHA256 hash is accurately calculated and included in the signature string. An empty string's hash is only for requests without a body.
• Response Status Codes: Pay attention to HTTP status codes returned by the API. A 401 Unauthorized typically points to an authentication issue (API key, signature, or timestamp). A 403 Forbidden might indicate insufficient permissions. A 400 Bad Request often means an issue with the request parameters or body.