Orderly uses the ed25519 elliptic curve standard for request authentication via signature verification. The necessary steps in order to send a valid request to Orderly are provided below.
1
Orderly account ID
Before being able to authenticate, you must first register your account and get your account ID.
The registration steps are provided here.
You need to add your account ID to the request header as orderly-account-id.
2
Access key (Orderly key)
Your Orderly public key needs to be added to the request header as orderly-key. To generate and add a new Orderly key, please refer to the documentation.
You can also get Orderly keys from frontend builders like WOOFi Pro.
3
Timestamp
Take the timestamp of the request in milliseconds and add it as orderly-timestamp to the request header.
4
Normalize request content
The message that you need to sign with your Orderly private key needs to be normalized to a string via this method:
Get current timestamp in milliseconds, e.g. 1649920583000
Append HTTP method in uppercase, e.g. POST
Append path of request including query parameters (without base URL), e.g. /v1/orders?symbol=PERP_BTC_USDC
(optional) If request has method body, JSON stringify this and append it
Use the normalized request content to generate a signature using the ed25519 algorithm, and encode the signature in base64 url-safe format. Add the result to the request headers as orderly-signature.
6
Content type
Add Content-Type header. All GET and DELETE requests use application/x-www-form-urlencoded. Any other method type uses application/json.
There is a three-layer checker to verify a request is valid. Orderly server only accepts the request that passes all checks. The checker contains the following:
The request would be considered expired and get rejected if the timestamp in orderly-timestamp header has 300+ seconds difference from the API server time.
The request must have an orderly-key header, and the orderly-key has to be added to the network via the Add Key functionality, matched with the account and is still valid (not expired yet).