Testing Your Integration

Before creating a strategy or trading, verify your signing against the signed no-op endpoint — full authentication runs, nothing is persisted, nothing is executed:

POST /bot/v1/spot/test

Sign it like any request (empty body or any JSON body — whatever you send must be signed). Success:

{
  "status": true,
  "message": "Signature valid",
  "data": {
    "apiKeyId": "0198f7c1-3f1a-7c02-9e51-2f4b8a01d9e3",
    "userId": "0198f6aa-1234-7abc-9def-0123456789ab",
    "serverTime": 1784500000000
  }
}

📘
Check your clock skew
Compare serverTime with the timestamp you sent. If |serverTime − your timestamp| approaches 30,000 ms, fix your clock (NTP) before going further — you're about to start failing the replay window.

Debugging a `401 Invalid signature`

The error includes a diagnostic digest:

{
  "status": false,
  "message": "Invalid signature",
  "messageSha256": "6f22...9e6d"
}

messageSha256 is the SHA-256 of the message the server built from the bytes it received. Hash the message you signed — sha256(timestamp + METHOD + path + body) — and compare:

Hashes differ → the bytes that arrived are not the bytes you signed. Usual suspects: body re-serialized by your HTTP client, editor whitespace/line endings, wrong path (missing prefix, trailing slash), wrong method case.
Hashes match → the message is fine; your secretKey is wrong for that apiKey.

👍
Other 401 messages are specific on purpose
Missing bot authentication headers · Request timestamp outside the allowed window · Unknown API key (also returned for revoked keys). Each one tells you exactly which check failed.

Next: Strategies & Your API key.

Check your clock skew

Debugging a 401 Invalid signature

Other 401 messages are specific on purpose

Debugging a `401 Invalid signature`