I'm trying to access the Mt.Gox API v2 via C# and HTTP requests. I've put together the following code based on various examples I found online (e.g. the nitrous documentation).

private string MakeRequest(string apiCall)
            var parameters = new Dictionary<string, string> ();
            parameters.Add ("tonce", Tonce.GenerateTonce().ToString());

            string path = Currency + "/" + apiCall;

            var request = new HttpPostRequest(BaseAddress + path, parameters);
            request.Request.Headers.Add ("Rest-Key", mApiKey);
            request.Request.Headers.Add ("Rest-Sign", mHmac.Sign(path, request.GetEncodedPostParams()));

            var response = request.Request.GetResponse();
            return response.ToString ();

(Here HttpPostRequest is a rather simple wrapper around the .NET HTTP request)

I call the code like this:

MakeRequest ("money/info");

This leads to a 403-Error from the Mt.Gox server (access denied).

What I checked:

  • Tonce is generated correctly
  • HMAC signing works correctly (tested with nitrous example)

And here is the code for my HTTP Post Request class:

public class HttpPostRequest
        public HttpWebRequest Request { get; set; }
        string mPostParams;

        public HttpPostRequest (string url, Dictionary<string,string> postParameters)
            mPostParams = "";
            foreach (string key in postParameters.Keys)
                mPostParams += Uri.EscapeDataString(key) + "="
                          + Uri.EscapeDataString(postParameters[key]) + "&";

            if(postParameters.Count > 0)
                mPostParams = mPostParams.Substring (0, mPostParams.Length - 1);

            Request = (HttpWebRequest)HttpWebRequest.Create(url);
            Request.Method = "POST";

            byte[] data = Encoding.ASCII.GetBytes(mPostParams);

            Request.ContentType = "application/x-www-form-urlencoded";
            Request.ContentLength = data.Length;
            Request.UserAgent = "Mozilla/4.0 (compatible; MtGoxTradeCLI)";

            Stream requestStream = Request.GetRequestStream();
            requestStream.Write(data, 0, data.Length);

        public string GetEncodedPostParams()
            return mPostParams;

        public string Send()
            HttpWebResponse myHttpWebResponse = (HttpWebResponse)Request.GetResponse();
            Stream responseStream = myHttpWebResponse.GetResponseStream();
            StreamReader myStreamReader = new StreamReader(responseStream, Encoding.Default);
            string pageContent = myStreamReader.ReadToEnd();
            return pageContent;

And my HMAC class:

class HmacSigner
    private readonly string mSecret;

    public HmacSigner(string secret)
        mSecret = secret;

    public string Sign(string method, string postData)
        string message = method + '\0' + postData;
        HMACSHA512 hmac = new HMACSHA512(Encoding.Default.GetBytes(message));
        hmac.Key = Convert.FromBase64String(mSecret);
        return Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(message)), Base64FormattingOptions.None);

Does anyone have an idea what's going wrong here? Why is my authentication not working? Thanks!

  • Btw: the error message from Mt.Gox also says that the Rest-Key is missing. I'm not sure what that means since I'm adding the Rest-Key to the request headers as shown above... – Boris Dec 19 '13 at 6:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.