From 22ab875cd57bc77d63641e11e3080e8ff4653eb6 Mon Sep 17 00:00:00 2001 From: rcsh <163504257+rcsh1@users.noreply.github.com> Date: Tue, 7 Jul 2026 22:36:03 +0800 Subject: [PATCH] =?UTF-8?q?docs:=20=E6=98=8E=E7=A1=AE=20Cobo=20Auth=20Nonc?= =?UTF-8?q?e=20=E5=8F=96=E5=80=BC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- v2/guides/overview/cobo-auth.mdx | 18 ++++++++++++++++-- v2_cn/guides/overview/cobo-auth.mdx | 20 +++++++++++++++++--- 2 files changed, 33 insertions(+), 5 deletions(-) diff --git a/v2/guides/overview/cobo-auth.mdx b/v2/guides/overview/cobo-auth.mdx index 0795ae97..e89ac296 100644 --- a/v2/guides/overview/cobo-auth.mdx +++ b/v2/guides/overview/cobo-auth.mdx @@ -23,7 +23,7 @@ headers = { ``` - Biz-Api-Key: The API key used for the request. For more details, refer to [API key](#api-key). -- Biz-Api-Nonce: A random string used as the request nonce. +- Biz-Api-Nonce: The nonce value for this request. Cobo signing helpers set this to the current Unix timestamp in milliseconds (for example, `1718587017026`). This value must exactly match the `NONCE` component in `str_to_sign`. For details, refer to [Nonce](#nonce). - Biz-Api-Signature: The API signature. To learn how to calculate an API signature, see [Calculate an API Signature](#calculate-the-api-signature). If you are using Cobo's WaaS SDKs, you only need to provide your API secret because the SDKs handles the remaining steps for you. @@ -137,7 +137,21 @@ The Development and Production environments use **separate Cobo Portals with sep ## Nonce -In WaaS 2.0 authentication, Nonce refers to the value of the `Biz-Api-Nonce` request header. This can be any random string. +In WaaS 2.0 authentication, Nonce refers to the value of the `Biz-Api-Nonce` request header. Cobo signing helpers generate it automatically as the current Unix timestamp in milliseconds, such as `1718587017026`. + +The value in the `Biz-Api-Nonce` request header must exactly match the `NONCE` component in `str_to_sign`. For example, the following pair is valid because both places use the same millisecond timestamp: + +```text +Biz-Api-Nonce: 1718587017026 +str_to_sign = GET|/v2/transactions/transfer|1718587017026|chain_id=ETH&limit=10| +``` + +The following pair is invalid because the request header and `str_to_sign` use different nonce values: + +```text +Biz-Api-Nonce: 1718587017026 +str_to_sign = GET|/v2/transactions/transfer|1718587017027|chain_id=ETH&limit=10| +``` ## Calculate the API signature diff --git a/v2_cn/guides/overview/cobo-auth.mdx b/v2_cn/guides/overview/cobo-auth.mdx index f0499940..4df122c5 100644 --- a/v2_cn/guides/overview/cobo-auth.mdx +++ b/v2_cn/guides/overview/cobo-auth.mdx @@ -13,7 +13,7 @@ import WaasSkillReminder from '/snippets/waas_skill_reminder_cn.mdx'; 为确保您加密资产的安全访问，WaaS 服务要求您使用 EdDSA 签名对每个 API 请求进行签名（可公开访问的 API 操作除外）。 -您需要在请求头中提供 API Key、`Biz-Api-Nonce`（随机字符串）和 API 签名： +您需要在请求头中提供 API Key、`Biz-Api-Nonce`（Nonce）和 API 签名： ``` headers = { @@ -24,7 +24,7 @@ headers = { ``` - Biz-Api-Key：用于请求的 API Key。更多详情，请参阅 [API Key](#api-key)。 -- Biz-Api-Nonce：用作请求 nonce 的随机字符串。 +- Biz-Api-Nonce：本次请求的 Nonce 值。Cobo 签名辅助工具会将其设置为当前 Unix 毫秒时间戳，例如 `1718587017026`。该值必须与 `str_to_sign` 中的 `NONCE` 组件完全相同。更多详情，请参阅 [Nonce](#nonce)。 - Biz-Api-Signature：API 签名。要了解如何计算 API 签名，请参阅[计算 API 签名](#calculate-the-api-signature)。 如果您使用 Cobo 的 WaaS SDK，您只需提供 API Key，因为 SDK 会为您处理其余步骤。 @@ -139,7 +139,21 @@ Public Key (Hex): ## Nonce -在 WaaS 2.0 身份验证中，Nonce 指请求头 `Biz-Api-Nonce` 的值，可以是任意随机字符串。 +在 WaaS 2.0 身份验证中，Nonce 指请求头 `Biz-Api-Nonce` 的值。Cobo 签名辅助工具会自动将其生成为当前 Unix 毫秒时间戳，例如 `1718587017026`。 + +请求头 `Biz-Api-Nonce` 的值必须与 `str_to_sign` 中的 `NONCE` 组件完全相同。例如，以下配对有效，因为两个位置使用了相同的毫秒时间戳： + +```text +Biz-Api-Nonce: 1718587017026 +str_to_sign = GET|/v2/transactions/transfer|1718587017026|chain_id=ETH&limit=10| +``` + +以下配对无效，因为请求头和 `str_to_sign` 使用了不同的 Nonce 值： + +```text +Biz-Api-Nonce: 1718587017026 +str_to_sign = GET|/v2/transactions/transfer|1718587017027|chain_id=ETH&limit=10| +``` ## 计算 API 签名