Request Signing

To ensure the integrity and authenticity of requests, certain API keys require requests to be signed using HMAC-SHA256.

Signature parameters should be used when passing sensitive information. If the following URL parameters are present in the URL:

withdraw_address

Request Structure

Option 1: Header-based (recommended)

GET https://flow.onside.io?withdraw_address={withdraw_address}
X-Api-Key: your_api_key
X-Signature: your_signature

Option 2: Query-based

GET https://flow.onside.io?api_key={your_api_key}&withdraw_address={withdraw_address}&signature={your_signature}

Signature generation

const crypto = require("crypto");

const withdrawalAddress = "your_withdraw_address";
const secretKey = "your_secret_key"; // Provided securely by Onside

const stringToSign = `withdraw_address=${withdrawalAddress}`;
const signature = crypto
  .createHmac("sha256", secretKey)
  .update(stringToSign)
  .digest("hex");

Secret key

To enable request signing and receive your secret key, please contact your account manager at Onside Flow.