"Signature for this request is not valid."

mdwdig · January 20, 2021, 11:33pm

Hello,

I’m looking for some help to understand why I’m getting this error.

Here’s the code that I’m running in a small bash script. It always returns “Signature for this request is not valid.”

#!/bin/bash
BINANCE_API_KEY=“the_api_key”
BINANCE_SECRET_KEY=“the_secret_key”
RECV_WINDOW=5000
REQUEST_TIMESTAMP="$(( $(date +%s) *1000))"
API_ENDPOINT=“https://api.binance.com”
QUERY_STRING=“symbol=LTCBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.01&recvWindow=5000&timestamp=$REQUEST_TIMESTAMP”
SIGNATURE=$(echo -n “$QUERY_STRING” | openssl dgst -sha256 -hmac $BINANCE_SECRET_KEY)
SIGNATURE=${SIGNATURE#(stdin)= }
curl -H “X-MBX-APIKEY: $BINANCE_API_KEY” -X POST “$API_ENDPOINT/api/v3/order” -d “$QUERY_STRING&signature=$SIGNATURE” | jq ‘.’
echo

dino · January 21, 2021, 12:11am

Hey, we have a shell script for hashing the signature, https://github.com/binance-exchange/binance-signature-examples/blob/master/shell/signature.sh

Hope this will be helpful to understand.

MJW · January 21, 2021, 1:58am

The code is good. I use my api key and secret and it succeeds on both my personal MAC and a Linux server. The top possible cause is you used wrong secret.
If you still think you did everything correctly, try below ultimate way:

Borrow another computer or rent a linux box from any cloud service vendor to try again
If #0 fails, create a pair of api key/secret on testnet using https://testnet.binance.vision/
Use your bash script with api key/secret updated as well as API_ENDPOINT updated to create an order on spot testnet
If it still fails, post all the code here (including testnet api key/secret)

mdwdig · January 21, 2021, 11:22am

The script failed on my other mac as well.
Could you guide me on which page I can create a pair of api key/secret for testnet? (even though i do not understand how it is related to live environment where my script is actually not working) Edit: ok sorry, i found it.
Tried - failed
code with testnet keys (i guess testnet keys are safe to post)

#!/bin/bash

BINANCE_API_KEY=“mg5g6AuRtizgDIk955Iv1OshAlgqX5LPG8OwqDGk0sKphwTLQLjv1lEAJZJjEKLb”
BINANCE_SECRET_KEY=“yVClY8vloUNTqgxXihw8wEWnkck7fdVingYGqtx8NjeGaMXA5KqLeAMWDbJPf79Z”

RECV_WINDOW=5000
REQUEST_TIMESTAMP="$(( $(date +%s) *1000))"
API_ENDPOINT=“https://testnet.binance.vision”

QUERY_STRING=“symbol=LTCBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.01&recvWindow=5000&timestamp=$REQUEST_TIMESTAMP”
SIGNATURE=$(echo -n “$QUERY_STRING” | openssl dgst -sha256 -hmac $BINANCE_SECRET_KEY)
SIGNATURE=${SIGNATURE#(stdin)= }
curl -H “X-MBX-APIKEY: $BINANCE_API_KEY” -X POST “$API_ENDPOINT/api/v3/order” -d “$QUERY_STRING&signature=$SIGNATURE” | jq ‘.’
echo

mdwdig · January 21, 2021, 12:43pm

I still have a question unanswered:
Why I’m not getting (stdin)= prefix in final signature when using this code SIGNATURE=$(echo -n “$QUERY_STRING” | openssl dgst -sha256 -hmac $BINANCE_SECRET_KEY) ?

Just asking, because everyone seem to get that prefix and need to use the extra code to remove it.

aisling · January 21, 2021, 5:37pm

I think the mentioned prefix comes from different openssl version, I’m on LibreSSL 2.8.3 and macos and don’t get it either, so using same script (without SIGNATURE=${SIGNATURE#(stdin)= }) still works fine. Unfortunately, I’m not able to replicate your issue using the same code:

#!/bin/bash

BINANCE_API_KEY="mg5g6AuRtizgDIk955Iv1OshAlgqX5LPG8OwqDGk0sKphwTLQLjv1lEAJZJjEKLb"
BINANCE_SECRET_KEY="yVClY8vloUNTqgxXihw8wEWnkck7fdVingYGqtx8NjeGaMXA5KqLeAMWDbJPf79Z"

REQUEST_TIMESTAMP="$(( $(date +%s) *1000))"
API_ENDPOINT="https://testnet.binance.vision"

QUERY_STRING="symbol=LTCBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.01&recvWindow=5000&timestamp=$REQUEST_TIMESTAMP"

SIGNATURE=$(echo -n "$QUERY_STRING" | openssl dgst -sha256 -hmac $BINANCE_SECRET_KEY)

curl -H "X-MBX-APIKEY: $BINANCE_API_KEY" -X POST "$API_ENDPOINT/api/v3/order" -d "$QUERY_STRING&signature=$SIGNATURE" | jq '.'
echo

(Signature = 57d98b101ac39149cc553048ae1a8dced1f5e09214e6e59f4d690ee30fe2e705 )

So far, it seems the api key pair is not the issue, neither is code or other processes interfering, have you tried sending the request from a different IP?

mdwdig · January 21, 2021, 6:07pm

I think yes. I switched to mobile hotspot (over 4G network) and got same error.

mdwdig · January 21, 2021, 6:13pm

I have same version.

I have tried two different macs as well.
Only thing i have not tried yet is different OS. But it will take time to arrange, i should have soon a box with windows and also a clean installed mac.
But despite of everything, it still feels very weird.

Like really… what else could be wrong?

A question that remains unanswered is: how is API related to Binance Account state? Is it possible that account is somehow restricted or misconfigured so that it affects how API reacts?

Also, is it possible to check something from “backend-side”? some logs maybe? does backend really respond with that error because the signature is wrong or it is just covering some internal issue with it?

MJW · January 21, 2021, 10:08pm

Please try a different computer before getting back to us. If something doesn’t work on one box but succeeds on another without any change, it’s very unlikely the fault on the server end not to mention it’s absolutely not account related

mdwdig · January 22, 2021, 3:50am

I mentioned it already before that I already have tried two different macs as well.

mdwdig · January 25, 2021, 11:47am

So

several days passed again and I’m out of ideas.

script works - Others have confirmed
keys are correct - Others have confirmed
tried on different macs --> issue still persists
tried on different ip addresses --> issue still persists

But I’m still having the issue here.

Suspecting that it is still some account limitation or misconfiguration - (because i cant validate or verify it, who can?)

aisling · January 29, 2021, 2:16pm

Don’t think it’s account related, because we’ve tested the script using the same keys you’ve generated from Testnet and got not issue on our side. Maybe create another script using a different language for another try?

mdwdig · February 3, 2021, 7:13am

Hey Binance - you are not helping me
Today I have created another API Key and added it to third party service that uses binance. And Guess what - it did not work.
here seems to be some major fukup with access or something else.

dino · February 4, 2021, 1:33am

We don’t have any context of how the third part working with Binance API. If you could get account information by the method provided above, there is nothing wrong from Binance API side. Please consult the platform for details. thanks

dino · February 4, 2021, 1:34am