[SOLVED] Problem with Kraken REST auth.

[MikeRossov]

Hi,
I can't reproduce the example for signing a request with Kraken REST API.

Here is my code :

I'm using : CryptoLib4Pascal, SimpleBaseLib4Pascal and HashLib4Pascal (linux x86_64)

var
  result: widestring;
  LHMAC:IHMAC;
  IHashCrypt: IHash;
  URI_path, Private_Key, Encoded_Payload: string;
  Nonce: int64;
begin

  // process is :  HMAC-SHA512 of (URI path + SHA256(nonce + POST data)) and base64 decoded secret API key
  // process is described at https://docs.kraken.com/exchange/guides/rest/authentication#python

  Private_Key := 'kQH5HW/8p1uGOVjbgWA7FunAmGO8lsSUXNsu3eow76sz84Q18fWxnyRzBHCd3pd5nE9qa99HAZtuZuj6F1huXg==';
  Nonce := 1616492376594;
  Encoded_Payload := 'nonce=1616492376594&ordertype=limit&pair=XBTUSD&price=37500&type=buy&volume=1.25';
  URI_path := '/0/private/AddOrder';

  LHMAC := THashFactory.THMAC.CreateHMAC(THashFactory.TCrypto.CreateSHA2_512);
  IHashCrypt:=THashFactory.TCrypto.CreateSHA2_256();
  LHMAC.Key := TBase64.Default.Decode(Private_Key);
  result := TBase64.Default.Encode(LHMAC.ComputeString(URI_path+IHashCrypt.ComputeString(inttostr(nonce)+Encoded_Payload,TEncoding.UTF8).ToString(), TEncoding.UTF8).GetBytes());

  // result should be : '4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ=='

  writeln(result);


end.

I don't understand why it not work.

[LeP]

Try Pyhton code step by step and FPC and see when and where they differs, not so difficult (i.e. encode, hash, message. etc ... VALUES).

[Thaddy]

I think TEncoding.UTF8 is wrong. It needs to be a bytewise encoding. Have to test.

[MikeRossov]

I think TEncoding.UTF8 is wrong. It needs to be a bytewise encoding. Have to test.

Using ANSI, ASCII, UTF7 and UTF8 give the same result.
With UNICODE and BIGENDIANUNICODE result is not the same than above.

None of these encoding gives the expected result.

[MikeRossov]

Try Pyhton code step by step and FPC and see when and where they differs, not so difficult (i.e. encode, hash, message. etc ... VALUES).

I don't know how to do this.
I'm not coding in Python.

[bytebites]

Example run:

Code: Python  [Select][+][-]

1. import urllib.parse
2. import hashlib
3. import hmac
4. import base64
5.  
6. def get_kraken_signature(urlpath, data, secret):
7.  
8.     if isinstance(data, str):
9.         encoded = (str(json.loads(data)["nonce"]) + data).encode()
10.     else:
11.         encoded = (str(data["nonce"]) + urllib.parse.urlencode(data)).encode()
12.     print(f'{encoded= }')
13.     message = urlpath.encode() + hashlib.sha256(encoded).digest()
14.     print(f'{message= }')
15.     mac = hmac.new(base64.b64decode(secret), message, hashlib.sha512)
16.     print(f'{mac.digest()= }')
17.     sigdigest = base64.b64encode(mac.digest())
18.     print(f'{sigdigest= }')
19.     return sigdigest.decode()
20.  
21. api_sec = "kQH5HW/8p1uGOVjbgWA7FunAmGO8lsSUXNsu3eow76sz84Q18fWxnyRzBHCd3pd5nE9qa99HAZtuZuj6F1huXg=="
22.  
23. payload = {
24.         "nonce": "1616492376594",
25.         "ordertype": "limit",
26.         "pair": "XBTUSD",
27.         "price": 37500,
28.         "type": "buy",
29.         "volume": 1.25
30.         }
31.  
32. signature = get_kraken_signature("/0/private/AddOrder", payload, api_sec)
33. print("API-Sign: {}".format(signature))

encoded= b'1616492376594nonce=1616492376594&ordertype=limit&pair=XBTUSD&price=37500&type=buy&volume=1.25'
message= b'/0/private/AddOrder#\xa1\xc1\xb3Lj\x11\xd6A\xaf\x0f$hH\x96\xcb\x90\xf6o\xb9\x91\x12\\\x83\xdc5{\xdc=\xc1F\xf1'
mac.digest()= b'\xe3\xf7i\xc5\xbd\xe2O\x8bi\xfd\x90\x95\x13\x04\xa7\x12\xc2\xf1\xc7F\xea\xca\x12\xe9u\xf3\xa9s\xa7\xe7\xec\xe4|\xf9@\xa5I^g\xf4N\x9aI/\x0c>\xd9\xd1~\x9d\xf6l\x06\xf4\x9ef\xd1\x9f\xa1\xfc\x9d\xdc\x0bQ'
sigdigest= b'4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ=='
API-Sign: 4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ==

[MikeRossov]

Example run:

Code: Python  [Select][+][-]

1. import urllib.parse
2. import hashlib
3. import hmac
4. import base64
5.  
6. def get_kraken_signature(urlpath, data, secret):
7.  
8.     if isinstance(data, str):
9.         encoded = (str(json.loads(data)["nonce"]) + data).encode()
10.     else:
11.         encoded = (str(data["nonce"]) + urllib.parse.urlencode(data)).encode()
12.     print(f'{encoded= }')
13.     message = urlpath.encode() + hashlib.sha256(encoded).digest()
14.     print(f'{message= }')
15.     mac = hmac.new(base64.b64decode(secret), message, hashlib.sha512)
16.     print(f'{mac.digest()= }')
17.     sigdigest = base64.b64encode(mac.digest())
18.     print(f'{sigdigest= }')
19.     return sigdigest.decode()
20.  
21. api_sec = "kQH5HW/8p1uGOVjbgWA7FunAmGO8lsSUXNsu3eow76sz84Q18fWxnyRzBHCd3pd5nE9qa99HAZtuZuj6F1huXg=="
22.  
23. payload = {
24.         "nonce": "1616492376594",
25.         "ordertype": "limit",
26.         "pair": "XBTUSD",
27.         "price": 37500,
28.         "type": "buy",
29.         "volume": 1.25
30.         }
31.  
32. signature = get_kraken_signature("/0/private/AddOrder", payload, api_sec)
33. print("API-Sign: {}".format(signature))

encoded= b'1616492376594nonce=1616492376594&ordertype=limit&pair=XBTUSD&price=37500&type=buy&volume=1.25'
message= b'/0/private/AddOrder#\xa1\xc1\xb3Lj\x11\xd6A\xaf\x0f$hH\x96\xcb\x90\xf6o\xb9\x91\x12\\\x83\xdc5{\xdc=\xc1F\xf1'
mac.digest()= b'\xe3\xf7i\xc5\xbd\xe2O\x8bi\xfd\x90\x95\x13\x04\xa7\x12\xc2\xf1\xc7F\xea\xca\x12\xe9u\xf3\xa9s\xa7\xe7\xec\xe4|\xf9@\xa5I^g\xf4N\x9aI/\x0c>\xd9\xd1~\x9d\xf6l\x06\xf4\x9ef\xd1\x9f\xa1\xfc\x9d\xdc\x0bQ'
sigdigest= b'4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ=='
API-Sign: 4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ==

Great thanks for that.

I've got

message: '/0/private/AddOrder23A1C1B34C6A11D641AF0F24684896CB90F66FB991125C83DC357BDC3DC146F1'
my mac is not the same as yours.

maybe my decoded key is wrong ?
converted to hex it give : (because of unprintable character)
key: '9101F91D6FFCA75B863958DB81603B16E9C09863BC96C4945CDB2EDDEA30EFAB33F38435F1F5B19F247304709DDE97799C4F6A6BDF47019B6E66E8FA17586E'

[paweld]

Code: Pascal  [Select][+][-]

1. uses
2.   HlpIHash, HlpIHashInfo, HlpConverters, HlpHashFactory, SbpBase64;
3.  
4. var
5.   Result: String;
6.   LHMAC: IHMAC;
7.   IHashCrypt: IHash;
8.   URI_path, Private_Key, Encoded_Payload: String;
9.   barr1, barr2: TBytes;
10.   Nonce: Int64;
11. begin
12.   Private_Key := 'kQH5HW/8p1uGOVjbgWA7FunAmGO8lsSUXNsu3eow76sz84Q18fWxnyRzBHCd3pd5nE9qa99HAZtuZuj6F1huXg==';
13.   Nonce := 1616492376594;
14.   Encoded_Payload := 'nonce=1616492376594&ordertype=limit&pair=XBTUSD&price=37500&type=buy&volume=1.25';
15.   URI_path := '/0/private/AddOrder';
16.   LHMAC := THashFactory.THMAC.CreateHMAC(THashFactory.TCrypto.CreateSHA2_512);
17.   IHashCrypt := THashFactory.TCrypto.CreateSHA2_256();
18.   barr1 := TConverters.ConvertStringToBytes(IntToStr(nonce) + Encoded_Payload, TEncoding.UTF8);
19.   barr2 := Concat(TConverters.ConvertStringToBytes(URI_path, TEncoding.UTF8), IHashCrypt.ComputeBytes(barr1).GetBytes());
20.   LHMAC.Key := TBase64.Default.Decode(Private_Key);
21.   Result := TBase64.Default.Encode(LHMAC.ComputeBytes(barr2).GetBytes());
22.   // result should be : '4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ=='
23.   WriteLn(Result); //  4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ==
24. end.

[MikeRossov]

Great thanks Paweld.
with the example it work.

So now I know that the "API-sign" header is good.

I'm doing my test with "Get Account Balance"

model is :
curl --request POST \
  --url https://api.kraken.com/0/private/Balance \
  --header 'API-Key: <api-key>' \
  --header 'API-Sign: <api-key>' \               <--- the sign is supposed to take place here
  --header 'Content-Type: application/json' \
  --data '
{
  "nonce": 123,
  "rebase_multiplier": "rebased"
}

I've got tonce: int64 for the nonce param
before creating the json and the sign I do : tonce := DateTimeToUnix(now,false)*1000;

for "API-Key" I'm using my API public key
for "API-Sign" I'm using your code with my API secret key, '/0/private/Balance' as path and 'nonce='+inttostr(tonce)+'&rebase_multiplier=rebased' as the encoded payload
my message body is '{"nonce": '+inttostr(tonce)+',"rebase_multiplier": "rebased"}'

the server response is always the same : {"error":["EAPI:Invalid key"]}

Authorisations for the API key is ALL except deposit, view closed orders and export data.
I've set my own public IPv4 adress as white list IP
and there is no time limitation for the key validity

(it's not my first exchange site. I've already done working REST API in freepascal for CoinEx, Exmo, Binance, OKX, Crypto, Bitvavo, Mexc and the permanently closed Probit.)

[paweld]

See the example in the attachment

[MikeRossov]

OK I've seen my mistake.

As in the example I was using an encoded payload 'nonce='+inttostr(tonce)+'&rebase_multiplier=rebased'.
And for POST the payload must be the JSON : '{"nonce": '+inttostr(tonce)+',"rebase_multiplier": "rebased"}'

So it couldn't work.

Now all is working.

Great thanks to all.

[paweld]

You can use an encoded payload, but in that case you must send the exact same string via POST - that is, when calculating the API-Sign, you must use the exact same string that you are sending (json or urlencoding)

[MikeRossov]

OK, thank you for the info.