Trying to get authentication with BitFinex to work. Docs here: https://www.bitfinex.com/pages/api

Say the client wants to make a request to POST


With a payload of { "request":"/v1/order/new", "nonce": "1234", "option1": ... }

The nonce provided must be strictly increasing.

To authenticate a request, use the following:

payload = parameters-dictionary -> JSON encode -> base64 
signature = HMAC-SHA384(payload, api-secret) as hexadecimal 
send (api-key, payload, signature) 

These are encoded as HTTP headers named: X-BFX-APIKEY X-BFX-PAYLOAD X-BFX-SIGNATURE

Here is the c# code, which follows the above example, but generates a HTTP 400 Bad Request. Any ideas how to fix?

        long nonce = DateTime.Now.ToUnixTimestampMS(); //returns a strictly increasing timestamp based number e.g. 1402207693893

        string path = "https://api.bitfinex.com/v1/balances";
        string paramDict = "{\"request\": \"/v1/balances\",\"nonce\": \"" + nonce + "\"}"; //ie. {"request": "/v1/balances","nonce": "1402207693893"}
        string payload = Convert.ToBase64String(Encoding.UTF8.GetBytes(paramDict));

        //API Sign
        HMACSHA384 hmac = new HMACSHA384(Encoding.UTF8.GetBytes(APISECRET));           //My API SECRET
        byte[] hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
        string hexHash = BitConverter.ToString(hash).Replace("-", "");

        NameValueCollection headers = new NameValueCollection();
        headers.Add("X-BFX-APIKEY", APIKEY);                                            //My API KEY
        headers.Add("X-BFX-PAYLOAD", payload);
        headers.Add("X-BFX-SIGNATURE", hexHash);

        //POST data
            //create post request
            HttpWebRequest request = (HttpWebRequest) HttpWebRequest.Create(path);
            request.KeepAlive = true;
            request.Method = "POST";

            //add headers

            //write out payload
            byte[] byteArray = System.Text.Encoding.UTF8.GetBytes(paramDict);
            request.ContentLength = byteArray.Length;
            using (var writer = request.GetRequestStream()){writer.Write(byteArray, 0, byteArray.Length);}

            //read reply
            using (var response = request.GetResponse() as System.Net.HttpWebResponse)
                using (var reader = new System.IO.StreamReader(response.GetResponseStream()))
                    //get reply (JSON)
                    string responseContent = reader.ReadToEnd();
        catch (Exception e)
            //always throws an exception here

Finally discovered the fix: hexhash has to be lower case:

string hexHash = BitConverter.ToString(hash).Replace("-", "").ToLower();
  • 2
    Such a weird API... Thanks for both your question and (self) response – RichardW1001 Sep 11 '14 at 14:55
  • I am having the same issue in python, but the hexdigest is already in lower case... – fccoelho Feb 20 '16 at 16:21
  • did you ever get the order/new to work ? I am still getting bad request despite running properly on other calls such as balances etc. – Farhan Ahmed Dec 14 '17 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.