Authentication failed with the Coinbase API

[w_t]

Goodmorning everyone,
I have an authentication problem with my account, through the Coinbase.com API.

I tell you what's happening to me:

- I opened a private account on Coinbase.com,
- I created my API Keys,
- I have enabled all the permissions to the keys, this means that I can perform all the operations possible with those APIs.
- I read the developer's guide and I tried to write a small script to test the authentication, but nothing completely useless ..., I return this error:

Code:

string(237) "{"errors":[{"id":"authentication_error","message":"invalid signature"}],"warnings":[{"id":"missing_version","message":"Please supply API version (YYYY-MM-DD) as CB-VERSION header","url":"https://developers.coinbase.com/api#versioning"}]}"

Since the examples are in other languages ​​but I use PHP, I think I have made a mistake during the conversion of the script.

This is the link of the official guide:

https://developers.coinbase.com/docs/wallet/api-key-authentication

This is my script:

Code:

<?
$API_KEY = '<---MY API KEY--->';
$API_SECRET = '<---MY API KEY SECRET--->';

$body = '';
$timestamp = time();
$message = $timestamp . 'GET' . 'https://www.mysite.it' . $body;
$signature = hash_hmac('SHA256', $message, $API_SECRET);

$headers = array(
					'CB-ACCESS-SIGN: '.$signature,
					'CB-ACCESS-TIMESTAMP: '.$timestamp,
					'CB-ACCESS-KEY: '.$API_KEY
				); 

$api_url = 'https://api.coinbase.com/v2/user';

$ch = curl_init(); 
curl_setopt($ch, CURLOPT_URL, $api_url);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, 1);
	
$data = curl_exec($ch); 


if(curl_errno($ch))
{ 
    echo "Errore: " . curl_error($ch); 
}
else
{ 
    var_dump($data); 
    curl_close($ch); 
} 
?>

Do you give me your opinion?
I've been stuck here for 5 days and I can not understand what I'm missing.
The assistance of Coinbase does not answer me and I have a project to deliver blocked.

Thank you very much for any useful advice.

[1715651904]

1715651904

[1715651904]

1715651904

[1715651904]

1715651904

[starmyc]

Code:

$message = $timestamp . 'GET' . 'https://www.mysite.it' . $body;
$signature = hash_hmac('SHA256', $message, $API_SECRET);

I did only take a quick look, but this seems wrong to me. According to the documentation, the "message" string must contain the path + params of the request url (eg: "/v2/exchange-rates?currency=USD"), not the complete url. If your complete url is "http://www.mysite.it/", then the request path you need to use is only "/". If you are calling https://api.coinbase.com/v2/user then you need to use '/v2/user' in $message.

[w_t]

Code:

$message = $timestamp . 'GET' . 'https://www.mysite.it' . $body;
$signature = hash_hmac('SHA256', $message, $API_SECRET);

I did only take a quick look, but this seems wrong to me. According to the documentation, the "message" string must contain the path + params (eg: "/v2/exchange-rates?currency=USD"), not the complete url. If your complete url is "http://www.mysite.it/", then the request path you need to use is only "/".

Excuse me if I do not understand,

my full URL what do you mean?
The redirect address that I put during the registration of my account?

[starmyc]

I fixed my answer after testing. You can't use your website url in $message, you have to use the requestPath of the url you're querying. If you're querying "https://api.coinbase.com/v2/user", then you've to use "/v2/user" in $message to create the signature.

Please note it is recommended to use the CB-VERSION header as well.

The following code works:

Code:

<?php

$API_KEY = 'x';
$API_SECRET = 'x';

$body = '';
$timestamp = time();
$message = $timestamp . 'GET' . '/v2/user' . $body;
$signature = hash_hmac('SHA256', $message, $API_SECRET);
$version = '2017-11-11';

$headers = array(
                    'CB-ACCESS-SIGN: ' . $signature,
                    'CB-ACCESS-TIMESTAMP: ' . $timestamp,
                    'CB-ACCESS-KEY: ' . $API_KEY,
                    'CB-VERSION: ' . $version
                ); 

$api_url = 'https://api.coinbase.com/v2/user';

$ch = curl_init(); 
curl_setopt($ch, CURLOPT_URL, $api_url);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, 1);
    
$data = curl_exec($ch);

if(curl_errno($ch))
{
    echo "Errore: " . curl_error($ch);
}
else
{
    echo $data;
}
curl_close($ch);
?>