NovaDax Authentication: API Keys and HMAC Signatures (2026)

Authentication overview

NovaDax provides programmatic access to its cryptocurrency exchange platform through a REST API, enabling developers to automate trading, retrieve market data, and manage account resources. Access to this API is secured using a combination of API keys and Hash-based Message Authentication Code (HMAC) signatures. This approach is a common method for authenticating requests in financial APIs, ensuring that only authorized users can perform actions and that the integrity of transmitted data is maintained HMAC specification RFC 2104.

The NovaDax API requires each request to include an Access Key and a cryptographic signature generated using a corresponding Secret Key. The signature process involves hashing specific request parameters with the Secret Key, which verifies the request's authenticity and ensures it has not been tampered with in transit. This mechanism is crucial for protecting sensitive operations such as placing orders, initiating withdrawals, or accessing private account information.

Developers integrating with NovaDax must understand the precise steps for generating signatures, as even minor discrepancies in payload formatting or timestamp handling can lead to authentication failures. The official NovaDax API documentation provides detailed instructions and examples in various programming languages to assist with correct implementation NovaDax API documentation on GitHub.

Supported authentication methods

NovaDax's API primarily supports a single, robust authentication method: API Key with HMAC-SHA256 signature. This method is standard for securing access to trading platforms due to its balance of security and practicality for machine-to-machine communication.

API Keys with HMAC-SHA256 Signatures

This method involves two primary components:

1. Access Key: A publicly visible identifier that accompanies each API request. It tells the NovaDax API which user account is making the request.
2. Secret Key: A private, confidential key known only to the user and NovaDax. This key is used to generate a unique digital signature for each API request. The signature proves that the request originated from the legitimate owner of the API keys and that the request's content has not been altered since it was signed.

The HMAC-SHA256 algorithm ensures that the signature is derived from the request's payload, a timestamp, and the Secret Key. This prevents replay attacks and ensures that the request's integrity is verified upon receipt by the NovaDax servers. Every request to a private endpoint must include the Access Key, a timestamp, and the HMAC signature in its headers or parameters, as specified by the NovaDax API NovaDax authentication scheme details.

Authentication Method Comparison

Getting your credentials

To obtain API credentials for NovaDax, users must navigate to their account settings on the NovaDax website. The process typically involves generating a new API key pair, which consists of an Access Key and a Secret Key. It is critical to store the Secret Key securely immediately after generation, as it is usually displayed only once and cannot be retrieved later.

Steps to Generate API Keys:

1. Log in to Your NovaDax Account: Access your NovaDax account through the official website NovaDax homepage.
2. Navigate to API Management: Look for a section related to 'API Management', 'API Settings', or 'Security' within your account dashboard. The exact path may vary but is generally found under profile or security settings.
3. Generate New API Key: Select the option to create a new API key. During this step, you may be prompted to set specific permissions for the new key. For instance, you might choose to grant permissions only for reading market data, or for trading, or for withdrawals. It is a security best practice to grant only the minimum necessary permissions for each API key.
4. Record Secret Key: Upon generation, the system will display your Access Key and Secret Key. The Secret Key is highly sensitive and should be recorded and stored securely. NovaDax, like many exchanges, will only show the Secret Key once. If lost, you will need to revoke the old key and generate a new one.
5. Configure IP Whitelisting (Optional but Recommended): Some API management interfaces allow you to restrict API key usage to specific IP addresses. If your application or server has a static IP, whitelisting it adds an additional layer of security by preventing unauthorized access even if your keys are compromised.

Confirmation and activation of API keys may require two-factor authentication (2FA), depending on your account's security settings. Always refer to the latest NovaDax documentation for the most accurate and up-to-date credential generation process NovaDax help center.

Authenticated request example

Authenticating a request to the NovaDax API involves several steps: constructing the request payload, generating a timestamp, and creating an HMAC-SHA256 signature using your Secret Key. The signed request then includes the Access Key, timestamp, and signature in its headers.

Python Example for a Signed Request

This example demonstrates how to construct a signed GET request to a hypothetical private endpoint requiring authentication. This is a simplified example; actual implementation may require more complex payload structures for POST requests and error handling.

import hashlib
import hmac
import time
import requests

# --- Your NovaDax API Credentials ---
ACCESS_KEY = "YOUR_NOVADAX_ACCESS_KEY"
SECRET_KEY = "YOUR_NOVADAX_SECRET_KEY"

# --- API Endpoint Details ---
BASE_URL = "https://api.novadax.com.br"
ENDPOINT = "/v1/user/account"

def generate_signature(secret_key, timestamp, method, request_path, body=""):
    # NovaDax often expects a specific string to be signed.
    # Check NovaDax documentation for exact signature string format.
    # Example: timestamp + method.upper() + request_path + body (if POST/PUT)
    # For GET, body is usually empty.
    
    string_to_sign = f"{timestamp}{method.upper()}{request_path}{body}"
    
    # Encode secret key and string to sign to bytes
    secret_key_bytes = secret_key.encode('utf-8')
    string_to_sign_bytes = string_to_sign.encode('utf-8')
    
    # Generate HMAC-SHA256 signature
    signature = hmac.new(secret_key_bytes, string_to_sign_bytes, hashlib.sha256).hexdigest()
    return signature

def make_authenticated_request(access_key, secret_key, method, endpoint, params=None, data=None):
    timestamp = str(int(time.time() * 1000)) # Milliseconds timestamp
    request_path = f"{ENDPOINT}"
    if params:
        # For GET requests, query parameters are part of the path for signing purposes.
        # NovaDax might require a specific sorted/formatted parameter string.
        # Consult NovaDax docs for exact path construction for signing.
        sorted_params = '&'.join([f"{k}={v}" for k, v in sorted(params.items())])
        request_path = f"{ENDPOINT}?{sorted_params}"

    body_str = "" # For GET requests, body is empty
    if data and method.upper() != 'GET':
        # For POST/PUT, the JSON body often needs to be included in the signature string.
        # Ensure the body is a JSON string, not a Python dict.
        import json
        body_str = json.dumps(data)

    signature = generate_signature(secret_key, timestamp, method, request_path, body_str)

    headers = {
        'X-NovaDAX-Access-Key': access_key,
        'X-NovaDAX-Signature': signature,
        'X-NovaDAX-Timestamp': timestamp,
        'Content-Type': 'application/json' if data else 'application/x-www-form-urlencoded'
    }

    url = f"{BASE_URL}{endpoint}"
    
    if method.upper() == 'GET':
        response = requests.get(url, headers=headers, params=params)
    elif method.upper() == 'POST':
        response = requests.post(url, headers=headers, json=data)
    # Add other HTTP methods (PUT, DELETE) as needed
    else:
        raise ValueError(f"Unsupported HTTP method: {method}")

    return response

# --- Example Usage (replace with actual endpoint and parameters) ---
# response = make_authenticated_request(ACCESS_KEY, SECRET_KEY, 'GET', ENDPOINT)
# print(response.status_code)
# print(response.json())

# Example for a hypothetical POST request (e.g., placing an order)
# order_data = {"symbol": "BTC_BRL", "type": "LIMIT", "side": "BUY", "price": "100000", "amount": "0.001"}
# response = make_authenticated_request(ACCESS_KEY, SECRET_KEY, 'POST', '/v1/order', data=order_data)
# print(response.status_code)
# print(response.json())

Important: Always refer to the official NovaDax API documentation for the precise structure of the signature string, header names, and endpoint details, as these can be sensitive to changes and vary between different API versions or specific endpoints.

Security best practices

Securing your NovaDax API integration is crucial to protect your funds and account information. Adhering to these best practices reduces the risk of unauthorized access and potential financial losses.

• Secure Storage of Secret Keys: Never hardcode your Secret Keys directly into your application's source code. Store them in environment variables, a secure configuration management system (e.g., HashiCorp Vault, AWS Secrets Manager, Google Secret Manager), or a dedicated secrets file that is not committed to version control. Ensure that access to these storage mechanisms is strictly controlled.

  Using environment variables is a common and relatively simple approach for server-side applications, while client-side applications should avoid storing Secret Keys directly.

• Least Privilege Principle: When generating API keys, assign only the minimum necessary permissions required for your application to function. For example, if your application only needs to read market data, do not grant it trading or withdrawal permissions. This limits the damage an attacker can inflict if a key is compromised.
• IP Whitelisting: If your application runs on servers with static IP addresses, configure IP whitelisting for your API keys within your NovaDax account settings. This ensures that API requests originating from any IP address not on your whitelist will be rejected, even if the Access Key and Secret Key are known to an attacker. This is a highly effective security measure Google Cloud API key best practices.
• Frequent Key Rotation: Periodically rotate your API keys. This means generating new keys and revoking old ones. A common practice is to rotate keys every 90 days or whenever there is a change in personnel or system configuration. This reduces the window of opportunity for a compromised key to be exploited.
• Monitor API Usage: Regularly review your NovaDax account's API usage logs for any unusual activity. Anomalies such as unexpected requests, high volumes from unknown IPs, or attempts to access unauthorized endpoints could indicate a compromise.
• Implement Rate Limit Handling: While not strictly an authentication practice, robust rate limit handling prevents your application from being temporarily blocked by the API, which could disrupt legitimate operations. Implement exponential backoff and retry mechanisms.
• Time Synchronization: Ensure that the system clock on your server or device making API requests is accurately synchronized. NovaDax's HMAC signature process relies on accurate timestamps, and significant clock drift can lead to signature validation failures.
• Secure Communication (HTTPS): Always use HTTPS for all API communications. NovaDax's API endpoints are served over HTTPS, which encrypts data in transit and prevents eavesdropping and man-in-the-middle attacks. Verify SSL/TLS certificates in your application.
• Error Handling: Implement comprehensive error handling for API responses, especially for authentication and authorization errors (e.g., HTTP 401 Unauthorized, 403 Forbidden). Log these errors securely for auditing and alert administrators to potential security issues.