Skip to main content

Quickstart

Goal: a 200 OK from a public endpoint first, then one signed request.

Step 1. Keys​

  1. Open Cobrex dashboard settings.
  2. Create or copy your API secret (used for HMAC signing).
  3. Note your User ID (u-…) and, for merchant flows, Merchant ID (m-…).

Step 2. Public request without signing​

The network and asset list does not require auth headers:

GET https://api.cobrex.com/public/assets
Accept: application/json

Expected response: an array of objects with network, asset, limits, and fees. If this works, DNS and TLS are fine.

Step 3. Signed request​

Protected endpoints need these headers:

HeaderPurpose
x-uid or x-midWho is calling: user or merchant
x-timestampCurrent time in seconds (Unix time)
x-signatureHMAC-SHA256 of the canonical string (below)

Canonical string to sign:

  1. Full URL of the request (scheme, host, path, and query exactly as sent).
  2. A newline \n.
  3. The same value you send in x-timestamp (in seconds).
  4. If there is a body (often POST/PUT/PATCH with JSON): \n and the raw body byte-for-byte as sent (after JSON.stringify).

For GET without a body, stop after step 3 — no third line and no trailing \n.

Compute:

x-signature = HMAC-SHA256( canonical_string , api_secret )

as a hex string (lowercase hex is common).

Minimal JavaScript (Node.js)​

No extra deps — use built-in crypto:

const crypto = require('crypto');

const apiSecret = process.env.COBREX_API_SECRET;
const baseUrl = 'https://api.cobrex.com/accounts';

const timestampSec = Math.floor(Date.now() / 1000); // seconds, not milliseconds

const canonical = `${baseUrl}\n${timestampSec}`;
const signature = crypto.createHmac('sha256', apiSecret).update(canonical).digest('hex');

// Pass signature and timestampSec as x-signature and x-timestamp

For POST with a body:

const bodyRaw = JSON.stringify({ asset: ['USDT', 'TRX'], network: 'TRON', client: 'demo' });
const url = 'https://api.cobrex.com/wallet';
const canonical = `${url}\n${timestampSec}\n${bodyRaw}`;

More detail, edge cases, and webhook verification: Authentication & signing.

Step 4. Interpret the response​

  • 2xx — success (many endpoints return 200).
  • 4xx — client error (signature, shape, permissions, not found).
  • 5xx — server error; retry with backoff.

Next: general endpoints (GET /accounts, balances) or payments / payouts.