Usage Examples | Bitnob API Reference

GET Request Example

These examples show how to make an authenticated GET request to the Bitnob API using the signing function defined above. For GET requests without a body, pass null as the body parameter — the signature is computed over just your client ID, timestamp, and nonce.

GET /api/balances

Response

POST Request Example

For POST/PUT requests, pass the JSON body to generateAuthHeaders so it is included in the HMAC computation. Any change to the payload — even reordering keys — will invalidate the signature, so sign the exact byte sequence you send on the wire.

Note

Use the /api/whoami endpoint to quickly verify your authentication is set up correctly before making other API calls.

POST /api/customers

Response

Validate Authentication

Use the /api/whoami endpoint to verify your credentials are working correctly. This endpoint accepts any HTTP method and any payload, and returns your authenticated client info.

It works with HMAC signature authentication.

Response Fields

activeboolean

Whether the client is currently active. Inactive clients cannot make authenticated requests.

active_company_idstring

UUID of the company this client is currently acting on behalf of.

auth_methodstring

The authentication mode used to sign the request. Always 'hmac'.

authenticatedboolean

Whether the request was successfully authenticated. Returns true when the HMAC signature is valid.

client_idstring

UUID of the client (API app) that made the request.

client_namestring

Human-readable name of the client, as configured on the Bitnob dashboard.

environmentstring

The environment the request was made against. One of 'sandbox' or 'live'.

metadataobject

Contextual details about the company attached to this client: company_id (UUID), company_name, company_slug, and org_status ('active', 'suspended', etc.).

permissionsarray | null

List of scoped permissions granted to this client. Null when the client has no scoped permissions (e.g. full account-level access).

timestampstring

RFC 3339 / ISO 8601 server timestamp of when the request was processed (UTC).

Validate Authentication

Response