API

• X-SPOTEX-KEY — your key id
• X-SPOTEX-TIMESTAMP — milliseconds since the epoch; within 5 s of server time (set X-SPOTEX-RECV-WINDOW up to 60000 ms for more). Sync from GET /api/public/v1/time.
• X-SPOTEX-SIGNATURE — hex HMAC-SHA256 of timestamp + METHOD + path + query + body with your secret

Path and query exactly as sent; the body is the exact JSON string sent, or nothing. Amounts are decimal strings — "0.015", never 0.015.

import { createHmac } from "node:crypto";

async function call(method, pathAndQuery, body) {
  const timestamp = String(Date.now());
  const raw = body ? JSON.stringify(body) : "";
  const signature = createHmac("sha256", SECRET)
    .update(timestamp + method + pathAndQuery + raw)
    .digest("hex");
  const res = await fetch(BASE_URL + pathAndQuery, {
    method,
    headers: {
      "X-SPOTEX-KEY": KEY_ID,
      "X-SPOTEX-TIMESTAMP": timestamp,
      "X-SPOTEX-SIGNATURE": signature,
      ...(raw && { "Content-Type": "application/json" }),
    },
    body: raw || undefined,
  });
  return res.json();
}

await call("POST", "/api/private/v1/order", {
  symbol: "BTC-USDT", side: "BUY", type: "LIMIT",
  price: "78000.00", size: "0.0150", timeInForce: "GTC",
  clientOrderId: "grid-42",
});

import hashlib, hmac, json, time, requests

def call(method, path_and_query, body=None):
    ts = str(int(time.time() * 1000))
    raw = json.dumps(body, separators=(",", ":")) if body else ""
    sig = hmac.new(SECRET.encode(), (ts + method + path_and_query + raw).encode(),
                   hashlib.sha256).hexdigest()
    headers = {"X-SPOTEX-KEY": KEY_ID, "X-SPOTEX-TIMESTAMP": ts, "X-SPOTEX-SIGNATURE": sig}
    if raw:
        headers["Content-Type"] = "application/json"
    return requests.request(method, BASE_URL + path_and_query,
                            headers=headers, data=raw or None).json()