generated: '2026-07-18'
method: searched
source: https://bitnomial.com/exchange/docs/api/rest/authentication/
docs: https://bitnomial.com/exchange/docs/api/rest/authentication/
summary:
  types: [hmac-signed-api-key]
  api_key_in: [header]
  oauth2_flows: []
  notes: >-
    No OAuth / OpenID Connect. Private REST endpoints are authenticated with a
    per-request HMAC-SHA256 request signature keyed on a symmetric AuthToken
    issued alongside a ConnectionId in the customer portal. There is therefore
    no OAuth scope surface (scopes/ is intentionally omitted).
schemes:
  - name: btnl-signature
    type: apiKey
    scheme: hmac-sha256-request-signature
    in: header
    headers:
      - name: BTNL-CONNECTION-ID
        description: Hex-encoded ConnectionId identifying the API connection.
      - name: BTNL-AUTH-TIMESTAMP
        description: >-
          ISO 8601 timestamp (YYYY-MM-DDTHH:MM:SS.SSSZ). Must be within 30
          seconds of exchange time or the request is rejected.
      - name: BTNL-SIGNATURE
        description: >-
          Base64-encoded HMAC-SHA256 signature. The signed string is
          method + requestPath + queryString + headers + body, using the
          ConnectionId's hex-encoded AuthToken as the HMAC secret.
    credential_model: >-
      A ConnectionId + AuthToken pair provisioned in the customer portal. A
      connection grants access to data for all accounts associated with it.
    sources: [docs]
public_endpoints:
  - path: /product/data/
    note: Product data is publicly available (no signature required).
  - path: /funding-rates
    note: Perpetual funding rates are publicly available.
  - path: /market-stats
    note: Market statistics are publicly available.