Skip to content

docs: 明确 Cobo Auth Nonce 取值 #377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rcsh1 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

docs: 明确 Cobo Auth Nonce 取值 #377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions v2/guides/overview/cobo-auth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ headers = {
```

- Biz-Api-Key: The API key used for the request. For more details, refer to [API key](#api-key).
- Biz-Api-Nonce: A random string used as the request nonce.
- Biz-Api-Nonce: The nonce value for this request. Cobo signing helpers set this to the current Unix timestamp in milliseconds (for example, `1718587017026`). This value must exactly match the `NONCE` component in `str_to_sign`. For details, refer to [Nonce](#nonce).
- Biz-Api-Signature: The API signature. To learn how to calculate an API signature, see [Calculate an API Signature](#calculate-the-api-signature).

If you are using Cobo's WaaS SDKs, you only need to provide your API secret because the SDKs handles the remaining steps for you.
Expand Down Expand Up @@ -137,7 +137,21 @@ The Development and Production environments use **separate Cobo Portals with sep

## Nonce

In WaaS 2.0 authentication, Nonce refers to the value of the `Biz-Api-Nonce` request header. This can be any random string.
In WaaS 2.0 authentication, Nonce refers to the value of the `Biz-Api-Nonce` request header. Cobo signing helpers generate it automatically as the current Unix timestamp in milliseconds, such as `1718587017026`.

The value in the `Biz-Api-Nonce` request header must exactly match the `NONCE` component in `str_to_sign`. For example, the following pair is valid because both places use the same millisecond timestamp:

```text
Biz-Api-Nonce: 1718587017026
str_to_sign = GET|/v2/transactions/transfer|1718587017026|chain_id=ETH&limit=10|
```

The following pair is invalid because the request header and `str_to_sign` use different nonce values:

```text
Biz-Api-Nonce: 1718587017026
str_to_sign = GET|/v2/transactions/transfer|1718587017027|chain_id=ETH&limit=10|
```

## Calculate the API signature

Expand Down
20 changes: 17 additions & 3 deletions v2_cn/guides/overview/cobo-auth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import WaasSkillReminder from '/snippets/waas_skill_reminder_cn.mdx';

为确保您加密资产的安全访问，WaaS 服务要求您使用 EdDSA 签名对每个 API 请求进行签名（可公开访问的 API 操作除外）。

您需要在请求头中提供 API Key、`Biz-Api-Nonce`（随机字符串）和 API 签名：
您需要在请求头中提供 API Key、`Biz-Api-Nonce`（Nonce）和 API 签名：

```
headers = {
Expand All @@ -24,7 +24,7 @@ headers = {
```

- Biz-Api-Key：用于请求的 API Key。更多详情，请参阅 [API Key](#api-key)。
- Biz-Api-Nonce：用作请求 nonce 的随机字符串。
- Biz-Api-Nonce：本次请求的 Nonce 值。Cobo 签名辅助工具会将其设置为当前 Unix 毫秒时间戳，例如 `1718587017026`。该值必须与 `str_to_sign` 中的 `NONCE` 组件完全相同。更多详情，请参阅 [Nonce](#nonce)。
- Biz-Api-Signature：API 签名。要了解如何计算 API 签名，请参阅[计算 API 签名](#calculate-the-api-signature)。

如果您使用 Cobo 的 WaaS SDK，您只需提供 API Key，因为 SDK 会为您处理其余步骤。
Expand Down Expand Up @@ -139,7 +139,21 @@ Public Key (Hex):

## Nonce

在 WaaS 2.0 身份验证中，Nonce 指请求头 `Biz-Api-Nonce` 的值，可以是任意随机字符串。
在 WaaS 2.0 身份验证中，Nonce 指请求头 `Biz-Api-Nonce` 的值。Cobo 签名辅助工具会自动将其生成为当前 Unix 毫秒时间戳，例如 `1718587017026`。

请求头 `Biz-Api-Nonce` 的值必须与 `str_to_sign` 中的 `NONCE` 组件完全相同。例如，以下配对有效，因为两个位置使用了相同的毫秒时间戳：

```text
Biz-Api-Nonce: 1718587017026
str_to_sign = GET|/v2/transactions/transfer|1718587017026|chain_id=ETH&limit=10|
```

以下配对无效，因为请求头和 `str_to_sign` 使用了不同的 Nonce 值：

```text
Biz-Api-Nonce: 1718587017026
str_to_sign = GET|/v2/transactions/transfer|1718587017027|chain_id=ETH&limit=10|
```

<a name="calculate-the-api-signature"></a>
## 计算 API 签名
Expand Down