Authentication

headers = {
  "Biz-Api-Key": {YOUR_API_KEY}.hex(),
  "Biz-Api-Nonce": {Nonce},
  "Biz-Api-Signature": {YOUR_API_SIGNATURE}.hex(),
}

• Biz-Api-Key: The API key used for the request. For more details, refer to API key.
• Biz-Api-Nonce: The nonce. A nonce is the current time in Unix timestamp format, measured in milliseconds.
• Biz-Api-Signature: The API signature. To learn how to calculate an API signature, see Calculate an API Signature.

​

API key and API secret

​

API key

​

API secret

• The API key is included in API requests to identify the client to the Cobo payments service. It is required to be registered on Cobo Portal.
• The API secret is used to generate a signature for each API request. The Cobo payments service validates the signature to confirm the request’s authenticity and prevent tampering.

​

Generate an API key and an API secret

​

Use OpenSSL

openssl genpkey -algorithm ed25519 -out private_key.pem

openssl pkey -in private_key.pem -pubout -out public_key.pem

echo "Private Key (Hex):"
openssl pkey -in private_key.pem -text | grep 'priv:' -A 3 | tail -n +2 | tr -d ':\n ' && echo

echo "Public Key (Hex):"
openssl pkey -pubin -in public_key.pem -text | grep 'pub:' -A 3 | tail -n +2 | tr -d ':\n ' && echo

Private Key (Hex):
06f78882576ec0e05b1e51a33548da7e8cf958c190ba96be77b1c671f98a2b5f
Public Key (Hex):
5987dedc180167b7ab1d27e6009e5065d10d764cd85d7b64f8c968ca40326e28

​

Use the Python library

1. Install the PyNaCl Python library. In a terminal window, run the following command:
   pip install PyNaCl
   
2. Generate a key pair. Import the function from the Python library to generate a key pair using the Ed25519 algorithm as follows:
   from nacl.signing import SigningKey
   # Create a key pair.
   sk = SigningKey.generate()
   # Print the private key in hexadecimal format.
   print("private key:", sk.encode().hex())
   # Print the public key in hexadecimal format.
   print("public key:", sk.verify_key.encode().hex())
   

​

Register the API key

​

Nonce

​

Calculate the API signature

1. First, concatenate a string based on your request as follows: str_to_sign = {METHOD}|{PATH}|{TIMESTAMP}|{PARAMS}|{BODY}

   Field	Description	Example
   METHOD	The HTTP method.	GET
   PATH	The API endpoint.	/v2/payments/topup/address
   TIMESTAMP	The current time in Unix timestamp format, measured in milliseconds. This value must be the same as the nonce in the request header.	1718587017026
   PARAMS	(If applicable) The query parameters.	chain_id=ETH&limit=10
   BODY	(If applicable) The raw request body in string format.	{"name":"Default","wallet_subtype":"Asset","wallet_type":"Custodial"}

2. Use the hashlib library to perform SHA-256 hashing twice on the string as follows:
   import hashlib
   content_hash = hashlib.sha256(hashlib.sha256(str_to_sign.encode()).digest()).digest()
   
3. Use the API secret to sign the string as follows:
   from nacl.signing import SigningKey
   
   # Create an Ed25519 signing key. Replace `api_secret` with your API secret.
   sk = SigningKey(bytes.fromhex(api_secret))
   # Sign the hashed message
   signature = sk.sign(content_hash).signature.hex()