One post tagged with "security"

If you have integrated one exchange API you have integrated most of them. The signing scheme is near-universal: a key id, a secret, an HMAC over some canonical form of the request.

What varies — and what almost no documentation explains — is exactly which bytes go into the signature, what else the server checks, and in what order. Those details are the security. The HMAC is the easy part.