Create an API key in the KiiChain Pay dashboard, understand scopes and expiry, and learn how to authenticate and sign your API requests.
Last updated
Authorization: APIKey <your_api_key>curl https://backend.pay.kiichain.io/accounts/v1/countries \
-H "Authorization: APIKey $KII_API_KEY"payload = timestamp + "\n" + method + "\n" + uri + "\n" + bodyHashimport { createHash, createPrivateKey, sign } from "node:crypto";
const BASE_URL = "https://backend.pay.kiichain.io";
const API_KEY = process.env.KII_API_KEY!; // the opaque "api_key"
const PRIV_KEY = process.env.KII_PRIV_KEY!; // base64url "priv_key", shown once
const WRITE_METHODS = new Set(["POST", "PATCH", "PUT", "DELETE"]);
// The priv_key is the raw 64-byte Ed25519 key: seed (first 32) || public key (last 32).
const rawPrivKey = Buffer.from(PRIV_KEY, "base64url");
const signingKey = createPrivateKey({
format: "jwk",
key: {
kty: "OKP",
crv: "Ed25519",
d: rawPrivKey.subarray(0, 32).toString("base64url"), // private seed
x: rawPrivKey.subarray(32).toString("base64url"), // public key
},
});
/**
* `path` must include the query string, e.g. "/market/v1/quotes?type=onramp".
*/
export async function kiiFetch(method: string, path: string, body?: unknown) {
method = method.toUpperCase();
const rawBody = body === undefined ? "" : JSON.stringify(body);
const timestamp = Date.now().toString();
const headers: Record<string, string> = {
Authorization: `APIKey ${API_KEY}`,
"x-timestamp": timestamp,
};
if (WRITE_METHODS.has(method)) {
const bodyHash = createHash("sha256").update(rawBody, "utf8").digest("hex");
const payload = `${timestamp}\n${method}\n${path}\n${bodyHash}`;
headers["x-signature"] = sign(
null,
Buffer.from(payload, "utf8"),
signingKey,
).toString("base64url");
headers["Content-Type"] = "application/json";
}
return fetch(BASE_URL + path, {
method,
headers,
body: rawBody === "" ? undefined : rawBody,
});
}package kiipay
import (
"bytes"
"crypto/ed25519"
"crypto/sha256"
"encoding/base64"
"encoding/hex"
"fmt"
"net/http"
"os"
"strconv"
"time"
)
const baseURL = "https://backend.pay.kiichain.io"
var writeMethods = map[string]bool{
http.MethodPost: true, http.MethodPatch: true,
http.MethodPut: true, http.MethodDelete: true,
}
// KiiRequest builds and sends a signed KiiChain Pay API request.
// path must include the query string, e.g. "/market/v1/quotes?type=onramp".
func KiiRequest(method, path string, body []byte) (*http.Response, error) {
apiKey := os.Getenv("KII_API_KEY") // the opaque "api_key"
privKey := os.Getenv("KII_PRIV_KEY") // base64url "priv_key", shown once
timestamp := strconv.FormatInt(time.Now().Unix(), 10) // seconds or millis both work
req, err := http.NewRequest(method, baseURL+path, bytes.NewReader(body))
if err != nil {
return nil, err
}
req.Header.Set("Authorization", "APIKey "+apiKey)
req.Header.Set("x-timestamp", timestamp)
// Sign write requests (POST, PATCH, PUT, DELETE).
if writeMethods[method] {
sum := sha256.Sum256(body)
bodyHash := hex.EncodeToString(sum[:])
payload := fmt.Sprintf("%s\n%s\n%s\n%s", timestamp, method, path, bodyHash)
// priv_key decodes to the raw 64-byte Ed25519 private key.
priv, err := base64.RawURLEncoding.DecodeString(privKey)
if err != nil {
return nil, err
}
if len(priv) != ed25519.PrivateKeySize {
return nil, fmt.Errorf("invalid priv_key: got %d bytes, want %d", len(priv), ed25519.PrivateKeySize)
}
sig := ed25519.Sign(ed25519.PrivateKey(priv), []byte(payload))
req.Header.Set("x-signature", base64.RawURLEncoding.EncodeToString(sig))
req.Header.Set("Content-Type", "application/json")
}
return http.DefaultClient.Do(req)
}