Fintrusted API

1. API keys & scopes

Create a key on the API Keys page. Each key has a secret (shown once — store it safely), an optional IP allowlist, a per-key rate limit, an optional expiry, and one or more scopes:

Public market-data endpoints need no key. Scopes are enforced per endpoint and default-deny: a key can only reach endpoints its scope explicitly grants.

2. Authenticating a request

Every authenticated request sends three headers:

The canonical string

The signature is computed over five newline-joined parts:

METHOD\nPATH\nAPI_KEY\nTIMESTAMP\nSORTED_PARAMS

• METHOD — the HTTP method, uppercase (e.g. GET, POST).
• PATH — the service-relative path, i.e. the URL path with the service prefix removed. You call https://fintrusted.com/tx/spot/add but you sign /spot/add (the leading /tx is not part of the signed path).
• API_KEY — the same key sent in X-API-KEY.
• TIMESTAMP — the same value sent in X-API-TIMESTAMP.
• SORTED_PARAMS — all request parameters (query string + form body), sorted by key; for a repeated key its values are sorted too. Join each as key=value with &, using the raw (URL-decoded) values. Empty when there are no params.

3. Signing — code examples

Placing a spot order (POST /tx/spot/add, signed path /spot/add):

Node.js

const crypto = require('crypto');

const API_KEY = 'your-key';
const API_SECRET = 'your-secret';
const BASE = 'https://fintrusted.com';

const method = 'POST';
const publicPath = '/tx/spot/add';   // what you request
const signPath = '/spot/add';        // what you sign (service prefix removed)
const params = { symbol: 'BTCUSDT', direction: 'BUY', price: '60000', amount: '0.001' };
const timestamp = Date.now().toString();

// SORTED_PARAMS: keys sorted; values sorted per key; key=value joined by &
const sorted = Object.keys(params).sort()
  .map(k => `${k}=${params[k]}`).join('&');

const canonical = [method, signPath, API_KEY, timestamp, sorted].join('\n');
const signature = crypto.createHmac('sha256', API_SECRET).update(canonical).digest('hex');

fetch(BASE + publicPath, {
  method,
  headers: {
    'X-API-KEY': API_KEY,
    'X-API-TIMESTAMP': timestamp,
    'X-API-SIGNATURE': signature,
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: new URLSearchParams(params),
}).then(r => r.json()).then(console.log);

Python

import time, hmac, hashlib, requests

API_KEY, API_SECRET = 'your-key', 'your-secret'
BASE = 'https://fintrusted.com'

method, public_path, sign_path = 'POST', '/tx/spot/add', '/spot/add'
params = {'symbol': 'BTCUSDT', 'direction': 'BUY', 'price': '60000', 'amount': '0.001'}
timestamp = str(int(time.time() * 1000))

sorted_params = '&'.join(f'{k}={params[k]}' for k in sorted(params))
canonical = '\n'.join([method, sign_path, API_KEY, timestamp, sorted_params])
signature = hmac.new(API_SECRET.encode(), canonical.encode(), hashlib.sha256).hexdigest()

r = requests.post(BASE + public_path, data=params, headers={
    'X-API-KEY': API_KEY,
    'X-API-TIMESTAMP': timestamp,
    'X-API-SIGNATURE': signature,
})
print(r.json())

For a GET endpoint (the spot reads), it's identical except the method is GET and the params go in the query string instead of the body — the canonical string uses GET and the same sorted params. Public market-data endpoints (no scope) are called without any of these headers.

4. Security & limits

• Timestamp window. A request is rejected if its X-API-TIMESTAMP is more than 5 seconds from server time — sign each request fresh.
• Replay protection. Each signature is single-use; re-sending an identical signed request is rejected.
• IP allowlist. If you set an allowlist on a key, requests from other IPs are rejected.
• Rate limit. Each key has a per-minute request limit (default 100). Exceeding it returns a rate-limit error.
• Account status. Every request re-checks your account standing, so a restriction takes effect immediately even though keys outlive login sessions.
• Transport. HTTPS only. Never expose your secret in client-side code.

5. Errors

Errors use the standard envelope: { "code": <n>, "message": "..." }. Common auth codes:

6. Endpoints

Use the method shown per endpoint: the spot read endpoints are GET (send params in the query string); everything else is POST (form-encoded body). Call the /tx… path; sign the service-relative path (the leading /tx is stripped before checking — see §2). The signature always covers the method you send, so it must match the method column.

Leverage is set when you open a position (the leverage param on /futures-order/open); to change it, close and reopen. Public market-data endpoints (depth, klines, mark price, funding rate, tickers) need no key. Account/wallet reads in the user service and programmatic withdrawals are not part of this version. Per-endpoint request parameters are listed with each call; a trade key can only act on your own account (it can never move funds off-platform).

7. Withdrawals

8. Exchange listing (CoinMarketCap / CoinGecko)

Public, read-only market-data endpoints in the standard formats that listing aggregators poll. No API key or signature — they serve aggregate market data only (no balances, PII or internal ids). Rate-limited to 120 requests/min per IP. All figures are this exchange’s own on-exchange trades and order book (never mirrored external-venue volume), and cover enabled & visible pairs only. Pairs use the underscore form BTC_USDT.

Base path is the market service context. These are for aggregator submission (CoinMarketCap, CoinGecko and compatible listing kits); a normal integration should use the keyed endpoints above.