Coinsquare Login Portal

REST API: HMAC Authentication and Order Placement

All authenticated REST API calls require **HMAC-SHA256 signing** using the API Secret Key to verify request authenticity. The payload must be correctly structured and include mandatory fields to prevent malformed or fraudulent requests. This method ties every transaction back to the logged-in user, upholding auditability and non-repudiation, core tenets of financial compliance. The primary domain is used for all live trading activities.

// All private API calls are made to the live domain:
const BASE_URL = 'https://api.coinsquare.com/v1';

// Request requires: API Key, a Payload (including nonce), and the Signature.
const authHeaders = {
    'X-CS-KEY': apiKey,
    'X-CS-SIGNATURE': computedSignature,
    // Payload usually includes the JSON body, timestamp/nonce for integrity.
};
// Best practice: always use a new nonce (timestamp) for every signed request.
                    

WebSocket API: Streaming Market & Account Events

For real-time applications, the **WebSocket API** provides low-latency market data streams (order book, trades) and private account updates (order fills, balance changes). Developers must perform a secure authentication handshake when opening a private WebSocket session to link the stream to the logged-in user's permissions. This enables timely, accurate response to market movements, a necessity for algorithmic trading strategies.