Skip to Content
EnDocs
Overview
Authentication

Authentication

API Base URL

Production URL: https://bopenapi.bgwapi.io

API Key Application

Visit: https://portal-web3.bitget.com  to apply.

API Authentication

Required Headers

ParameterDescription
x-api-keyThe API Key obtained from us
x-api-timestampTimestamp of the API call, generated by the client based on local time. Requests will be rejected if the time difference from the server exceeds ±10 minutes
x-api-signatureAPI signature, generated using the algorithm described in this document. Requests will be rejected if the signature is invalid

Signature Algorithm

Signature Content Components

  • APIKey
  • APITimestamp (milliseconds)
  • Path
  • Query
  • Body: raw JSON string exactly as sent, without key-sorting

Note: Keys in the content JSON must be sorted in alphabetical order

curl -H 'x-api-key:'key' \ -H 'x-api-timestamp:17200001' \ -H 'x-api-signature:signature_to_be_calculated' \ https://{GATEWAY_URL}/swap/api/test?param1=test1&param2=test2 -d'{"data":"test"}' ===> Content is {"apiPath":"/swap/api/test","body":{\"data\":\"test\"},"param1":"test1", "param2":"test2", "x-api-key":"key", "x-api-timestamp":"17200001"}

Signature Generation

  • Sign the content using HMAC with the APISecret provided by our support team
  • Convert the signature result to a base64 string

Note

apiPath is the path without query parameters

SDK integration example

Go SDK

See:https://github.com/bitgetwallet/tob-api-sdk 

package example import ( context "context" bgw "github.com/bitgetwallet/tob-api-sdk" "github.com/bitgetwallet/tob-api-sdk/client" "github.com/bitgetwallet/tob-api-sdk/option" ) func do() { client := client.NewClient( option.HTTPClient(bgw.NewSigningHTTPClient(apiKey, apiSecret, nil)), ) resp, err := client.InstructionMode.InstructionQuote( context.Background(), &bgw.InstructionQuoteRequest{ FromContract: "fromContract", FromAmount: "fromAmount", FromChain: "fromChain", ToContract: "toContract", ToChain: "toChain", }, ) }

TypeScript SDK

See:https://github.com/bitgetwallet/tob-api-sdk-ts 

npm install @bitget-wallet/api

import { BitgetWalletApiClient } from "@bitget-wallet/api"; import { createSigningFetch } from "@bitget-wallet/api/auth"; const client = new BitgetWalletApiClient({ // Auto-sign every request (see Authentication below). fetch: createSigningFetch({ apiKey: xxx, apiSecret: xxx, }), }); const quote = await client.instructionMode.instructionQuote({ fromChain: "bnb", fromContract: "0x...", fromAmount: "1000000000000000000", toChain: "bnb", toContract: "0x...", }); console.log(quote);

Development Examples

Golang Signature Code

func signature(path, apiKey string, apiSecret, timestamp string, query map[string]string, body string) string { contentMap := make(map[string]string) contentMap["x-api-key"] = apiKey contentMap["x-api-timestamp"] = timestamp contentMap["apiPath"] = path for key, value := range query { contentMap[key] = value } contentMap["body"] = body content, _ := json.Marshal(contentMap) mac := hmac.New(sha256.New, []byte(apiSecret)) mac.Write(content) return base64.StdEncoding.EncodeToString(mac.Sum(nil)) }

Java Signature Code

package org.example; import com.google.gson.Gson; import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; import java.util.*; public class Main { private static String Signature(String path, String apiKey, String apiSecret, String timestamp, HashMap<String, String> query, String body) throws Exception { TreeMap<String, String> mapping = new TreeMap<>(); // Assemble content mapping.put("x-api-key", apiKey); mapping.put("x-api-timestamp", timestamp); mapping.put("apiPath", path); mapping.put("body", body); Set<Map.Entry<String, String>> entries = query.entrySet(); for (Map.Entry<String, String> mapEntry : entries) { mapping.put(mapEntry.getKey(), mapEntry.getValue()); } // Serialize Gson gson = new Gson(); String content = gson.toJson(mapping); // HMAC signature Mac sha256_HMAC = Mac.getInstance("HmacSha256"); SecretKeySpec secretKey = new SecretKeySpec(apiSecret.getBytes(), "HmacSha256"); sha256_HMAC.init(secretKey); byte[] mac = sha256_HMAC.doFinal(content.getBytes()); // Base64 encode Base64.Encoder base = Base64.getEncoder(); return base.encodeToString(mac); } public static void main(String[] args) throws Exception { HashMap<String, String> query = new HashMap<>(); query.put("key1", "val1"); query.put("key2", "val2"); System.out.println(Signature("/test", "123456", "7890", "1733366175000",query, "{\"body\":\"test\"}")); } }

Node.js Signature Code

function getSignature(apiPath, body, apiKey, apiSecret, timeStamp, queryParams = {}) { // build contentTpl with all keys (base fields + queryParams keys) const contentTpl = { "apiPath": "", "body": "", "x-api-key": "", "x-api-timestamp": "", }; // add queryParams keys to template if (queryParams && typeof queryParams === "object") { for (const key of Object.keys(queryParams)) { contentTpl[key] = ""; } } // build content with actual values const content = { "apiPath": apiPath, "body": body, "x-api-key": apiKey, "x-api-timestamp": timeStamp, }; if (queryParams && typeof queryParams === "object") { for (const [key, value] of Object.entries(queryParams)) { content[key] = String(value); } } // sort only by contentTpl keys const sortedKeys = Object.keys(contentTpl).sort(); const sortedContent = Object.fromEntries(sortedKeys.map(key => [key, content[key]])); const payload = JSON.stringify(sortedContent); return crypto .createHmac("sha256", apiSecret) .update(payload) .digest("base64"); }

HTTP Status Codes

Status CodeDescription
200Success
400Bad Request
403Forbidden (not whitelisted or invalid signature)
429Too Many Requests (rate limited)
Last updated on