> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.ripio.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> A authentication tutorial for using the Ripio API.

You can create API Credentials on: [https://app.ripio.com/profile?tab=api](https://app.ripio.com/profile?tab=api).

After creating the **API Credentials**, you'll need to save in a safe place two pieces of information, an **API Token** and a **Secret Key**. The credentials are required respectively to **Authenticate** and **Sign** all Private REST Requests.

**Attention**: The Secret Key can only be viewed once and cannot be retrieved later. **If you lose the Secret Key, delete the set of credentials and create a new one**.

## Headers

For all private routes, these Headers are required:

| Header                  | Description                                                                                                                                                                                          |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Authorization**       | The API key as a string.                                                                                                                                                                             |
| **Timestamp**           | A timestamp in milliseconds. See the Timestamp Security section for more details.                                                                                                                    |
| **Timestamp-tolerance** | An additional, non-required parameter, that you can send to specify the number of milliseconds after the timestamp for the request to be valid. See the Timestamp Security section for more details. |
| **Signature**           | See the Generating Signature section for more details.                                                                                                                                               |

## Timestamp Security

Timestamp Security is a security method to guarantee the validation of the acceptable time window, in addition to guaranteeing the uniqueness of the request **Signature**.

* **All Private Requests** also require a **Header** parameter,
  **Timestamp**, which must be the timestamp in milliseconds of when the
  request was created and sent. Can be generated with `Date.now()` if
  you're using JavaScript, for example.

* An additional parameter, **Timestamp-tolerance**, non-required, may be
  sent to specify the max number of milliseconds after the timestamp, that
  the request is valid. If Timestamp-tolerance is not sent, it defaults to
  **5000 (5 seconds)**.

* **It is recommended to use a small Timestamp-tolerance of 5000 (5
  seconds) or less. The maximum value is 60,000 (60 seconds)**.

## Generating Signature

To create a signature for all Private Requests, you must **encrypt** the
hash-based message using **sha256 HMAC** and encode it in **Base64**.

The **message** must contain:

```

Timestamp + HTTP Method + Path + JSON Payload

```

* Not including the **'+'** sign, just concatenate the content into a string.

* The **Timestamp** is the same as the one sent in the Header.

* For **GET** Requests, it is necessary to consider the **PATH** without
  **Query Params**. For example, this route:
  `/withdrawals/estimate-rate/ADA?network=cardano_testnet`. Just
  `/withdrawals/estimate-rate` is considered. Additionally, the **BODY** is
  considered an empty **String**.

* **JSON Payload** must be a string and must be the same as the one sent
  in the request **Body**.

**IMPORTANT:** To prevent an invalid signature, avoid using unnecessary
decimal places in the request body properties. For instance, use `1`
instead of `1.0`. Alternatively, you can also send numbers as strings in
the request body, ensuring they are in the same format but as strings.
For example:

```json theme={null}
{
  'amount': '0.01',
  'pair': 'BTC_BRL',
  'price': '300000', 
  'side': 'buy', 
  'type': 'limit'
}

```

## Examples

We provide functional examples of API authentication in multiple programming languages. You can find them in our GitHub repository: [https://github.com/ripio/api/tree/main/authentication](https://github.com/ripio/api/tree/main/authentication)