Cryptonator Authentication: API Keys and HMAC Signatures (2026)

Authentication overview

Access to the Cryptonator API requires authentication to ensure the security and integrity of user data and transactions. The Cryptonator API employs a signature-based authentication mechanism, combining an API Key for identification with an HMAC (Hash-based Message Authentication Code) signature for request verification. This approach helps to confirm the sender's identity and detect any unauthorized modifications to the request data during transmission.

All requests to private API endpoints, which include operations such as accessing wallet balances, initiating exchanges, or retrieving transaction history, must be authenticated. Public endpoints, such as those for retrieving current exchange rates, typically do not require authentication. Developers integrate their unique API Key and Secret into their application logic to generate the required signature for each authenticated request.

Supported authentication methods

Cryptonator's API relies on a two-part authentication system for secure access to private endpoints:

1. API Key: This public identifier is used to associate requests with your Cryptonator account. It is included directly in the request headers or parameters.
2. HMAC-SHA512 Signature: A cryptographic signature generated using your private API Secret and the request parameters. This signature proves the request's authenticity and integrity, ensuring it hasn't been tampered with and originates from your account. The HMAC standard is widely used for message authentication in API security, as detailed in the IETF RFC 2104 specification for HMAC.

The table below summarizes the authentication method:

Getting your credentials

To obtain your Cryptonator API credentials, follow these steps:

1. Log in to Cryptonator: Access your account on the Cryptonator website.
2. Navigate to API Settings: Look for a section related to API access, developer settings, or similar in your account dashboard. The exact path may vary but is typically found under 'Settings' or 'Profile'.
3. Generate API Key: Within the API settings, you should find an option to generate a new API Key and Secret. When you generate a new key pair, Cryptonator will provide you with both an API Key (public) and an API Secret (private). The API Secret is typically shown only once upon generation, so it is important to store it securely immediately. For detailed instructions, refer to the Cryptonator API documentation.
4. Store Securely: Once generated, store your API Key and Secret in a secure location. The API Secret should be treated with the same level of confidentiality as a password.

It is recommended to generate separate API keys for different applications or environments (e.g., development, staging, production) to enhance security and simplify credential management.

Authenticated request example

Authenticating a request to the Cryptonator API involves constructing a signature using your API Secret, the request parameters, and a nonce (a number used once). The general process is:

1. Prepare Request Parameters: Gather all parameters for your API call.
2. Create Signature String: Concatenate the parameters in a specific order, often including a timestamp or nonce.
3. Generate HMAC: Use your API Secret to create an HMAC-SHA512 hash of the signature string.
4. Include in Request: Add the API Key, nonce, and the generated HMAC signature to your HTTP request headers or body.

Here's a conceptual example for a GET request, assuming parameters are URL-encoded and sorted:

import hashlib
import hmac
import time
import requests

API_KEY = "YOUR_API_KEY"
API_SECRET = "YOUR_API_SECRET_HEX"

def create_signature(api_secret, params):
    # Sort parameters alphabetically by key
    sorted_params = sorted(params.items())
    
    # Concatenate parameters into a query string format
    query_string = "&".join([f"{key}={value}" for key, value in sorted_params])
    
    # The Cryptonator API documentation specifies how the raw string for signing should be formed.
    # This is a general example; refer to Cryptonator's specific requirements for exact string formation.
    
    # Example: nonce + query_string
    # For Cryptonator, the signing string might be different, e.g., `nonce + API_KEY + param1=value1¶m2=value2`
    # Refer to https://cryptonator.com/api for the precise signature string format.
    
    # For illustration, let's assume a simple case where the signing string is just the query_string for HMAC calculation
    # Cryptonator specific example might involve a nonce and other elements in the string to be signed.
    
    # Example signing string based on common patterns, adjust for Cryptonator's exact spec:
    # signing_string = str(nonce) + query_string 
    # Or, as per some examples, just the query string for HMAC, with nonce as a separate header
    
    # Let's assume the string to sign is derived from the query parameters and a nonce
    nonce = str(int(time.time() * 1000)) # Millisecond timestamp as nonce
    signing_payload = f"nonce={nonce}&{query_string}" # Example, check Cryptonator docs

    # Convert secret to bytes
    secret_bytes = bytes.fromhex(api_secret)
    
    # Create HMAC-SHA512 hash
    signature = hmac.new(secret_bytes, signing_payload.encode('utf-8'), hashlib.sha512).hexdigest()
    return nonce, signature

# Example API call to get a ticker
url = "https://api.cryptonator.com/api/full/btc-usd"

# Parameters for a hypothetical authenticated endpoint (Cryptonator ticker is public, this is illustrative for auth)
# For authenticated endpoints, parameters would be included in the signing process.
params = {
    "amount": "1",
    "currency": "BTC"
}

# For a public endpoint like full ticker, no signature is needed. 
# This example is purely for demonstrating HMAC construction for a hypothetical private endpoint.

# If this were a private endpoint, you would do:
# nonce, signature = create_signature(API_SECRET, params)
# headers = {
#     "X-Cryptonator-API-Key": API_KEY,
#     "X-Cryptonator-Nonce": nonce,
#     "X-Cryptonator-Signature": signature
# }
# response = requests.get(private_url, headers=headers, params=params) # or POST with data

# For the actual Cryptonator public ticker, no auth headers are needed:
response = requests.get(url)

if response.status_code == 200:
    print("Public Ticker Data:", response.json())
else:
    print(f"Error: {response.status_code} - {response.text}")

Always consult the official Cryptonator API documentation for the precise method of constructing the signature string, as this can vary for different endpoints and request types (GET vs. POST).

Security best practices

When working with Cryptonator API authentication, adherence to security best practices is essential to protect your account and assets:

• Protect your API Secret: Treat your API Secret like a password. Never hardcode it directly into client-side code, expose it in public repositories, or transmit it over insecure channels. Store it in environment variables, a secure configuration management system, or a secrets manager.
• Use HTTPS: Always interact with the Cryptonator API over HTTPS. This encrypts the communication channel, protecting your API Key, signature, and request data from interception during transit. The Mozilla Developer Network provides a detailed explanation of HTTPS.
• Rotate API Keys Regularly: Periodically generate new API Keys and Secrets, and revoke old ones. This minimizes the risk associated with a compromised key.
• Implement Rate Limiting and Error Handling: Build robust error handling and respect API rate limits to prevent your application from being flagged or temporarily blocked due to excessive requests.
• Principle of Least Privilege: If Cryptonator offers granular permissions for API keys, configure your keys with only the minimum necessary permissions required for your application's functionality. For example, if your application only needs to read balances, do not grant it withdrawal permissions.
• Secure Nonce Generation: Ensure your nonce generation is truly unique and increasing for each request to prevent replay attacks. A timestamp (like milliseconds since epoch) is a common and effective nonce.
• Monitor API Usage: Regularly review your API logs and account activity for any suspicious patterns or unauthorized access attempts.
• Use Official SDKs: If available and suitable for your project, use the official Cryptonator SDKs (PHP, Python, Node.js) as they often handle the complexities of signature generation and request signing securely.