I've been trying to implement a client for Kraken private API (https://www.kraken.com/help/api) and because I've been running into some issues with that, I've been trying to access that same API with cURL.
However, I can't get for the life of me get it to work and I think I may not be using the right command line tools to generate the hashes and digests.
When accessing the private API the following headers need to be added to the request:
API-Key = «key»
API-Sign = Message signature using HMAC-SHA512 of (URI path + SHA256(nonce + POST data)) and base64 decoded «secret»
On the command line I do the following steps:
echo -n "123nonce=123" | openssl sha256
result: (stdin)= 353f9df92ab1d5e5afe06bb7d1bb42a8ef6654b633d94818007aeafbaf03ca3d
echo -n "/0/private/Balance353f9df92ab1d5e5afe06bb7d1bb42a8ef6654b633d94818007aeafbaf03ca3d" | openssl sha512 -hmac $(echo -n "wqtzZWNyZXTCuw==" | base64 -d)
result: (stdin)= 6f19f8f058b0e6dc835692840ccdebc1c415f00d42b75b3d3c21ef5fd43f006e30cc9b51c63aba3268a534bf68978d60d2362bffd31c8125553fb8ec41b2f64d
echo -n "6f19f8f058b0e6dc835692840ccdebc1c415f00d42b75b3d3c21ef5fd43f006e30cc9b51c63aba3268a534bf68978d60d2362bffd31c8125553fb8ec41b2f64d" | base64
result:
NmYxOWY4ZjA1OGIwZTZkYzgzNTY5Mjg0MGNjZGViYzFjNDE1ZjAwZDQyYjc1YjNkM2MyMWVmNWZk
NDNmMDA2ZTMwY2M5YjUxYzYzYWJhMzI2OGE1MzRiZjY4OTc4ZDYwZDIzNjJiZmZkMzFjODEyNTU1
M2ZiOGVjNDFiMmY2NGQ=
curl -X POST -H "Accept: application/json" -H "API-Key: «key»" -H "API-Sign: NmYxOWY4ZjA1OGIwZTZkYzgzNTY5Mjg0MGNjZGViYzFjNDE1ZjAwZDQyYjc1YjNkM2MyMWVmNWZkNDNmMDA2ZTMwY2M5YjUxYzYzYWJhMzI2OGE1MzRiZjY4OTc4ZDYwZDIzNjJiZmZkMzFjODEyNTU1M2ZiOGVjNDFiMmY2NGQ=" -d "nonce=123" https://api.kraken.com/0/private/Balance
result (assuming valid «key» and «secret»): {"error":["EAPI:Invalid signature"]}
But no matter which permutations I try I keep getting the "Invalid signature" error.
These permutations include but are not limited to:
- Base64 encoding the API-Sign value (all publicly available Kraken clients do this),
- uppercasing whatever is to be Base64 encoded,
- leaving out the '/' in front of the URI path,
- leaving out the actual nonce number at the front of the SHA256.