Skip to main content
The Orderbook API uses wallet challenge authentication and short-lived JSON Web Tokens (JWTs). You prove control of a trading account by signing a server-issued challenge, then attach the resulting JWT to protected calls. Prerequisites:

​
Public and protected endpoints

Endpoints split into two groups: Protected endpoints require a JWT issued by the /auth flow. Attach the JWT to REST calls with:

​
Authentication flow

1

Request a challenge

Submit your accountId to POST /auth/challenge and receive a nonce message to sign.Challenge request:
Challenge response:
2

Sign the challenge

Sign the challenge message client-side with the account key.
3

Verify and receive a JWT

Submit accountId and signature to POST /auth/verify and receive a JWT.Verify request:
Verify response:

​
Supported account identifiers

​
Token lifetime

JWTs are short-lived. Re-authenticate before a long-running session expires or whenever a protected call returns 401. Re-authenticate before each WebSocket reconnect attempt — see WebSockets.
Never put a primary wallet private key in a bot process. Use a dedicated integration account, store secrets server-side, and start on testnet before placing mainnet orders.
WebSocket streams pass the JWT in the token query parameter, so WebSocket URLs are as sensitive as the token itself. Avoid logging full WebSocket URLs in production.

​
Next steps

Orders

Use your JWT to build, sign, and save orders through the placement flow.

WebSockets

Connect both authenticated streams and handle reconnects and token renewal.

Market data

Read the public endpoints that need no JWT: books, depth, trades, and quotes.

Limits and errors

Handle 401 renewals, rate limits, and the shared error response format.