curl --request POST \
--url https://api.hevn.finance/dapi/v1/auth/challenge \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
'import requests
url = "https://api.hevn.finance/dapi/v1/auth/challenge"
payload = {
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
email: 'jsmith@example.com',
publicKey: '<string>',
nonce: 123,
requestExpiry: 123,
signature: '<string>'
})
};
fetch('https://api.hevn.finance/dapi/v1/auth/challenge', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payload": "<string>",
"expiresAt": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}Start a developer-key login and receive the payload to sign
Start developer-key authentication. Sign the returned payload with the registered key and exchange it once through POST /auth/token before it expires.
curl --request POST \
--url https://api.hevn.finance/dapi/v1/auth/challenge \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
'import requests
url = "https://api.hevn.finance/dapi/v1/auth/challenge"
payload = {
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
email: 'jsmith@example.com',
publicKey: '<string>',
nonce: 123,
requestExpiry: 123,
signature: '<string>'
})
};
fetch('https://api.hevn.finance/dapi/v1/auth/challenge', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payload": "<string>",
"expiresAt": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}Authorizations
Platform access token from POST /auth/token, carrying the platform audience and the developer_key_id of the registration that minted it. It acts as your own account; name a client you created with X-Hevn-Account: cl_…. Every request re-checks that the registration is still active and that the caller's source IP is inside its allowlist. A token is valid only against the server that issued it, so sandbox tokens are refused in production and production tokens in the sandbox.
Headers
Body
Email address of the account that owns the registered developer key.
Base64 DER SubjectPublicKeyInfo for the registered P-256 developer key.
Caller-generated single-use number included in the signed authentication proof.
Unix time in milliseconds after which the signed request is refused.
Base64 DER ECDSA P-256/SHA-256 signature over the login proof message.
Was this page helpful?