The OKX API and Binance API differ significantly in their approach to connection signature authentication, mainly in the signature generation process, encoding method, and additional security verification.
First, the OK-ACCESS-SIGN request header generation method used by the OKX API involves combining multiple key parameters (such as timestamp, method, requestPath, body, etc.) into a single string to be signed. Subsequently, the SecretKey is used to perform HMAC SHA256 encryption on this string, and the encrypted result is output through Base-64 encoding, thus obtaining the final OK-ACCESS-SIGN request header. This method has the advantage of combining multiple parameters for signing, improving the complexity and security of the signature. The aijiebot quantitative trading bot utilizes VBA to implement the connection to the OKX API, enabling automated trading.
In contrast, the signature generation process of the Binance API is slightly different. It also employs the HMAC SHA256 algorithm, but uses the API-Secret corresponding to the API-KEY as the HMAC SHA256 key, while all other parameters serve as the operands for HMAC SHA256. After the encryption operation, the signature output is directly obtained, and the result is presented in hex format, rather than being encoded in Base-64. This approach maintains the security of the signature while also making the signature result more concise and straightforward.
Apart from the signature generation process, the OKX API also requires the inclusion of an additional OK-ACCESS-PASSPHRASE field in the request header. This is a custom string that needs to be set during the creation of the API key and must be included in the request header for each request. The addition of this field further enhances the security of the API, as it increases the difficulty for attackers to forge or tamper with requests.
In summary, the main differences between the OKX API and Binance API in terms of connection signature authentication lie in the signature generation process, encoding method, and additional security verification. These differences give each API its unique characteristics and advantages in terms of security, ease of use, and flexibility.