Authentication

GET /api/resource
X-API-Key: YOUR_API_KEY

const socket = new WebSocket('wss://ws.cvex.trade/ws/v1?api_key=YOUR_API_KEY');

{
  "status": "error",
  "code": 401,
  "message": "Authentication failed: Invalid API key"
}

POST https://api.cvex.trade/v1/trading/order
X-API-Key: YOUR_API_KEY
X-Signature: GENERATED_SIGNATURE

{
  "status": "error",
  "code": 401,
  "message": "Authentication failed: Invalid signature"
}

import hashlib
import json
import time
import requests
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat

API_PRIVATE_KEY_PATH = "private_key.pem"

MAKE_ORDER_URL = "https://api.cvex.trade/v1/trading/order"
HTTP_METHOD = "POST"
MAKE_ORDER_BODY = {
    "contract": "1",
    "limit_price": "57777",
    "quantity_steps": "1000",
    "reduce_only": False,
    "time_in_force": "GTC",
    "type": "limit",
    "timestamp": 0,
    "recv_window": 60000
}

# timestamp value will be replaced with a current ts below

def load_private_key(file_path):
    """Load and return the Ed25519 private key."""
    with open(file_path, "rb") as pem_file:
        return serialization.load_pem_private_key(pem_file.read(), password=None)

def create_headers(private_key, message):
    """Create headers with API key and signature."""
    pub_key = private_key.public_key().public_bytes(encoding=Encoding.Raw, format=PublicFormat.Raw).hex()
    hash_digest = hashlib.sha256(message.encode()).digest()
    # Sign the message using Ed25519
    signature_hex = private_key.sign(hash_digest).hex()
    return {"X-API-KEY": pub_key, "X-Signature": signature_hex}

if __name__ == "__main__":
    key = load_private_key(API_PRIVATE_KEY_PATH)

    MAKE_ORDER_BODY["timestamp"] = int(time.time() * 1000)
    message_for_signing = f"{HTTP_METHOD} {MAKE_ORDER_URL}\n{json.dumps(MAKE_ORDER_BODY)}"

    headers = create_headers(key, message_for_signing)
    response = requests.post(MAKE_ORDER_URL, json=MAKE_ORDER_BODY, headers=headers)

    if response.status_code >= 300:
        raise Exception(f"Request failed with status {response.status_code}: {response.text}")

    print(response.text)

import fs from 'fs';
import {
    createPublicKey,
    createPrivateKey,
    sign,
    createHash
} from 'crypto';

const API_PRIVATE_KEY_PATH = 'private_key.pem';
const API_BASE_URL = 'https://api.cvex.trade';

const MAKE_ORDER_URL = `${API_BASE_URL}/v1/trading/order`;
const HTTP_METHOD = 'POST';

/**
 * Constructs the order body as a JSON string.
 * @param {Object} params - Contains the order timestamp.
 * @returns {string} - JSON string for the order body.
 */
const makeOrderBody = ({ timestamp }) => JSON.stringify({
    contract: '1',
    customer_order_id: '123id71',
    limit_price: '61494',
    quantity_steps: '5',
    reduce_only: false,
    time_in_force: 'GTC',  // Good Till Cancelled
    type: 'limit',
    timestamp,
    recv_window: 60000
});

/**
 * Loads the private key from a specified file path.
 * @param {string} filePath - The path to the PEM file.
 * @returns {Object|null} - Returns the private key object or null if loading fails.
 */
const loadPrivateKey = (filePath) => {
    try {
        const pem = fs.readFileSync(filePath, 'utf8');
        return createPrivateKey({
            key: pem,
            format: 'pem',
            type: 'pkcs8',
        });
    } catch (error) {
        console.error('Error loading private key:', error.message);
        return null;
    }
};

/**
 * Extracts the API key from the private key by processing the DER public key.
 * @param {Object} privateKey - The private key object.
 * @returns {string} - The extracted API key in hexadecimal format.
 */
const getApiKey = (privateKey) => {
    const derPublicKey = createPublicKey(privateKey).export({ format: 'der', type: 'spki' });
    const rawPublicKey = derPublicKey.subarray(-32); // Extract the last 32 bytes (raw key)
    return rawPublicKey.toString('hex');
};

/**
 * Constructs the message to be signed by combining HTTP method, URL, and body.
 * @param {string} method - The HTTP method (e.g., POST).
 * @param {string} url - The request URL.
 * @param {string} body - The request body.
 * @returns {string} - The message to be signed.
 */
const getMessageForSigning = (method, url, body) => {
    return `${method} ${url}\n${body}`;
};

/**
 * Signs a message using the provided private key.
 * @param {Object} privateKey - The private key object.
 * @param {Buffer} message - The message hash to be signed.
 * @returns {string} - The generated signature in hexadecimal format.
 */
const signMessage = (privateKey, message) => {
    return sign(null, message, privateKey).toString('hex');
};

/**
 * Main function to handle the order creation flow.
 */
async function main() {
    const privateKey = loadPrivateKey(API_PRIVATE_KEY_PATH);
    if (!privateKey) {
        console.error('Private key is required to proceed.');
        return;
    }

    const apiKey = getApiKey(privateKey);
    const timestamp = Date.now();
    const bodyWithTimestamp = makeOrderBody({ timestamp });

    const messageForSigning = getMessageForSigning(HTTP_METHOD, MAKE_ORDER_URL, bodyWithTimestamp);
    const hash = createHash('sha256').update(messageForSigning).digest();

    const signatureHex = signMessage(privateKey, hash);

    const headers = {
        'Content-Type': 'application/json',
        'X-API-KEY': apiKey,
        'X-Signature': signatureHex,
    };

    try {
        const response = await fetch(MAKE_ORDER_URL, {
            method: HTTP_METHOD,
            headers,
            body: bodyWithTimestamp
        });

        const data = await response.json();

        if (data.error) {
            console.error('Order creation failed:', data.error);
        } else {
            console.log('Order created successfully:', data);
        }
    } catch (error) {
        console.error('Order request failed:', error.message);
    }
}

// Execute the main function
main();

package main

import (
	"bytes"
	"crypto/ed25519"
	"crypto/sha256"
	"crypto/x509"
	"encoding/hex"
	"encoding/pem"
	"fmt"
	"io"
	"log"
	"net/http"
	"os"
	"time"
)

const apiPrivateKeyPath = "private_key.pem"

const makeOrderURL = "https://api.cvex.trade/v1/trading/order"
const httpMethod = `POST`
const makeOrderBody = `{
  "contract": "1",
  "customer_order_id": "123id7",
  "limit_price": "61494",
  "quantity_steps": "5",
  "reduce_only": false,
  "time_in_force": "GTC",
  "type": "limit",
  "timestamp": %d,
  "recv_window": 60000
}`

func main() {
	pcs8PrivateKey, err := os.ReadFile(apiPrivateKeyPath)
	if err != nil {
		log.Fatal(err)
	}

	rawPrivateKey := parsePrivateKey(pcs8PrivateKey)
	pubKey := rawPrivateKey.Public()
	apiKey := hex.EncodeToString(pubKey.(ed25519.PublicKey))

	bodyWithTimestamp := fmt.Sprintf(makeOrderBody, time.Now().UnixMilli())
	messageForSigning := fmt.Sprintf("%s %s\n%s", httpMethod, makeOrderURL, bodyWithTimestamp)

	hash := sha256.New()

	_, err = hash.Write([]byte(messageForSigning))
	if err != nil {
		log.Fatal(err)
	}

	signedMessage := ed25519.Sign(rawPrivateKey, hash.Sum(nil))
	signatureHex := hex.EncodeToString(signedMessage)
	bodyReader := bytes.NewReader([]byte(bodyWithTimestamp))

	r, err := http.NewRequest(httpMethod, makeOrderURL, bodyReader)
	if err != nil {
		log.Fatal(err)
	}

	r.Header.Add("Content-Type", "application/json")
	r.Header.Add("X-API-KEY", apiKey)
	r.Header.Add("X-Signature", signatureHex)

	httpClient := http.DefaultClient
	resp, err := httpClient.Do(r)
	if err != nil {
		log.Fatal(err)
	}

	readBody, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}

	if resp.StatusCode > 299 {
		log.Fatalf("request is failed %d: %s", resp.StatusCode, string(readBody))
	}

	log.Println(string(readBody))
}

func parsePrivateKey(pemPrivateKey []byte) ed25519.PrivateKey {
	// Decode PEM-encoded private key
	block, _ := pem.Decode(pemPrivateKey)
	if block == nil {
		log.Fatal("failed to decode PEM block containing private key")
	}

	// Parse the DER-encoded private key
	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		log.Fatal(err)
	}

	// Convert the parsed private key to Ed25519
	ed25519PrivateKey, ok := key.(ed25519.PrivateKey)
	if !ok {
		log.Fatal("parsed key is not an Ed25519 private key")
	}

	return ed25519PrivateKey
}