Generate ed25519 Keys

Certain endpoints require an Ed25519 signature to be provided alongside the API key. These endpoints will specify the Api-Signature and Api-Timestamp headers as additional parameters.

Signatures are optional unless explicitly required, but are encouraged for all requests. If a signature is provided, it will be verified.

Signing keys

A signing key pair is generated by the user and the corresponding public key must be provided when creating an API key.

When creating an API key, you will be prompted to provide an Ed25519 public key. You must use the associated Ed25519 signing key (private key) when creating signatures for requests from this API key.

❗️

Please note

Signing keys (Ed25519 private keys) should be stored securely by the user. The signing key should only be used to derive request signatures and should never be sent in a request. Anchorage Digital will never request you share your private key.

Generating a signing key

The user must securely generate an Ed25519 key pair on their own hardware and retain both the public and private portions. The Anchorage Digital API accepts a 64-character (32 bytes) hex-encoded Ed25519 public key when creating an API access key.

# https://pypi.org/project/PyNaCl/

import nacl
import nacl.signing
import secrets

seed = secrets.token_bytes(32)

# Generate a new random signing key
signing_key = nacl.signing.SigningKey(seed)

# Obtain the hex-encoded signing key
print('Signing key:')
print(signing_key.encode().hex())

# Obtain the hex-encoded verify key for the given signing key
# Use this in the Anchorage Digital Web Dashboard when creating an API key
print('Public key:')
print(signing_key.verify_key.encode().hex())

Signing a request

To sign a request, generate a request signature using the Ed25519 private (signing) key and provide it alongside the request in the Api-Signature header.

To create a request signature, first concatenate the timestamp, method, request path, and body into a string. Then, create a signature of this message using the Ed25519 private key and hex-encode the output. Use this value as the Api-Signature header and use the timestamp value as the Api-Timestamp header.

• The method is an uppercase HTTP method (ex. GET, POST, DELETE)
• The request path should contain all query parameters (ex. /v2/transfers?foo=bar&baz=one%2Btwo%3Dthree)
  • Query parameters should be URL encoded
• The body is a stringified HTTP request body
• The body should be omitted if the request does not contain a body (ex. a GET or DELETE request)
• The timestamp is the same as the Api-Timestamp header
• The timestamp is a number of seconds since the Unix Epoch in UTC, and must be within one minute of the API service's time when the request is received

Reference signature

To verify your signature generation code is correct, generate a signature for the following request and timestamp using the provided signing key. If the generated signature matches the signature below, your signature generation code is correct.