Authentication

import base64, hashlib, hmac, json, time
import requests

BASE = "https://api.symbiosis.markets"
API_KEY_ID = "..."
API_SECRET = b"..."

def signed_request(method: str, path_and_query: str, body: dict | None = None):
    raw = json.dumps(body).encode() if body is not None else b""
    ts = str(int(time.time() * 1000))

    message = ts.encode() + b"\n" + method.encode() + b"\n" \
        + path_and_query.encode() + b"\n" + raw
    signature = base64.b64encode(
        hmac.new(API_SECRET, message, hashlib.sha256).digest()
    ).decode()

    return requests.request(
        method,
        BASE + path_and_query,
        data=raw if body is not None else None,
        headers={
            "APIKEY": API_KEY_ID,
            "X-Hmac-Timestamp": ts,
            "X-Hmac-Signature": signature,
            **({"Content-Type": "application/json"} if body is not None else {}),
        },
    )

# GET with query params — the query string is part of the signature.
r = signed_request("GET", "/custody/get-usdc-balance")

# POST with a body — sign the exact bytes sent.
r = signed_request("POST", "/rfq/request", {
    "asset_id": "0x...",
    "venue_id": "polymarket",
    "amount": "1000000",
    "side": "Bid",
})

import { createHmac } from "node:crypto";

const BASE = "https://api.symbiosis.markets";
const API_KEY_ID = "...";
const API_SECRET = "...";

async function signedRequest(
  method: string,
  pathAndQuery: string,
  body?: unknown,
): Promise<Response> {
  const raw = body === undefined ? "" : JSON.stringify(body);
  const ts = Date.now().toString();

  const message = `${ts}\n${method}\n${pathAndQuery}\n${raw}`;
  const signature = createHmac("sha256", API_SECRET)
    .update(message)
    .digest("base64");

  return fetch(BASE + pathAndQuery, {
    method,
    body: body === undefined ? undefined : raw,
    headers: {
      APIKEY: API_KEY_ID,
      "X-Hmac-Timestamp": ts,
      "X-Hmac-Signature": signature,
      ...(body === undefined ? {} : { "Content-Type": "application/json" }),
    },
  });
}