Authentication

OSL's v5 OpenAPI uses Header + HMAC-SHA512 signature authentication mechanism

All interface requests need to carry the following four parameters in the HTTP header:

Signature generation rules

Signature algorithm: HMAC-SHA512

The signature content is spliced in the following order:

signature_string = METHOD + ENDPOINT + EXPIRES + REQUEST_BODY

Description

Field	Example
METHOD	GET	HTTP method, uppercase required
ENDPOINT	/api/v1/order?id=1	Request path (including Query parameter)
EXPIRES	1731480000	Request expiration time (second timestamp)
REQUEST_BODY	`{"symbol":"BTCUSD"}`	Request body content; GET request is empty string

Example of splicing: signature_string = POST/api/v1/order? id = 11731480000 \{"symbol": "BTCUSD"\}

decoded_api_secret = Base64.decode(api_secret)

Generate signature:

api-signature = Base64(
    HMAC_SHA512(
        signature_string,
        decoded_api_secret
    )
)

Api-expires is recommended to be set to: current time + 15 seconds

Example: Math.round (Date.now ()/1000 + 15)

The server level will verify the validity of the time.