Kaynak doğrulamalı araştırma: Crypto Exchange API Request

Verified source facts

1. Binance documents timestamp and recvWindow checks for signed requests. 2. OKX documents a timestamp as part of the pre-hash string used for REST request signatures. 3. Coinbase documents short-lived authentication material and permission boundaries for CDP API keys. 4. Kraken documents an always-increasing nonce for private Spot REST requests and warns that invalid nonce behavior can cause failures.

Comparison at a glance

1. Control test: Clock source

A trading-control disclosure is meaningful only when converted into a testable rule. For clock source, inspect system time used for signing. Use a sandbox, non-production context, or the smallest reversible test available, then monitor NTP offset. Capture configuration and event evidence without recording credentials, and verify the documented cancel, reject, decrement, or history behavior.

Model the failure path, not just the setup path. Ask which strategy owns the maker and taker orders, which account boundary the venue evaluates, which message reveals intervention, and how reconciliation behaves after a partial fill or disconnect. Platform documentation describes supported settings; it cannot prove that an operator configured them correctly. In this dimension, upstream clock error is therefore an explicit audit gap.

The clock source row should end with a concrete monitoring rule tied to system time used for signing. Make the operator monitor NTP offset, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; upstream clock error remains a separate production risk until observed.

2. Control test: Timestamp format

For timestamp format, inspect seconds, milliseconds or ISO time. Use a sandbox, non-production context, or the smallest reversible test available, then test exact serialization.

In this dimension, SDK conversion is therefore an explicit audit gap.

The timestamp format row should end with a concrete monitoring rule tied to seconds, milliseconds or ISO time. Make the operator test exact serialization, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; SDK conversion remains a separate production risk until observed.

3. Control test: Validity window

For validity window, inspect maximum accepted age. Use a sandbox, non-production context, or the smallest reversible test available, then use the narrowest reliable window.

In this dimension, network-tail latency is therefore an explicit audit gap.

The validity window row should end with a concrete monitoring rule tied to maximum accepted age. Make the operator use the narrowest reliable window, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; network-tail latency remains a separate production risk until observed.

4. Control test: Nonce

For nonce, inspect monotonic per-key request value. Use a sandbox, non-production context, or the smallest reversible test available, then centralize allocation.

In this dimension, multi-process ordering is therefore an explicit audit gap.

The nonce row should end with a concrete monitoring rule tied to monotonic per-key request value. Make the operator centralize allocation, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; multi-process ordering remains a separate production risk until observed.

5. Control test: Signature scope

For signature scope, inspect method, path, body and timestamp. Use a sandbox, non-production context, or the smallest reversible test available, then canonicalize once.

In this dimension, proxy mutation is therefore an explicit audit gap.

The signature scope row should end with a concrete monitoring rule tied to method, path, body and timestamp. Make the operator canonicalize once, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; proxy mutation remains a separate production risk until observed.

6. Control test: Retry

For retry, inspect ambiguous timeout after submission. Use a sandbox, non-production context, or the smallest reversible test available, then query state before repeating.

In this dimension, server-side acceptance is therefore an explicit audit gap.

The retry row should end with a concrete monitoring rule tied to ambiguous timeout after submission. Make the operator query state before repeating, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; server-side acceptance remains a separate production risk until observed.

7. Control test: Idempotency

For idempotency, inspect duplicate action suppression. Use a sandbox, non-production context, or the smallest reversible test available, then use supported client identifiers.

In this dimension, venue-specific semantics is therefore an explicit audit gap.

The idempotency row should end with a concrete monitoring rule tied to duplicate action suppression. Make the operator use supported client identifiers, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; venue-specific semantics remains a separate production risk until observed.

8. Control test: Failover

For failover, inspect multiple hosts sharing credentials. Use a sandbox, non-production context, or the smallest reversible test available, then coordinate clock and nonce state.

In this dimension, split-brain is therefore an explicit audit gap.

The failover row should end with a concrete monitoring rule tied to multiple hosts sharing credentials. Make the operator coordinate clock and nonce state, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; split-brain remains a separate production risk until observed.

9. Control test: Telemetry

For telemetry, inspect rejections and request age. Use a sandbox, non-production context, or the smallest reversible test available, then alert on drift and replay codes.

In this dimension, hidden rate limiting is therefore an explicit audit gap.

The telemetry row should end with a concrete monitoring rule tied to rejections and request age. Make the operator alert on drift and replay codes, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; hidden rate limiting remains a separate production risk until observed.

10. Control test: Recovery

For recovery, inspect resynchronizing after error. Use a sandbox, non-production context, or the smallest reversible test available, then pause writes and reconcile.

In this dimension, unobserved side effect is therefore an explicit audit gap.

The recovery row should end with a concrete monitoring rule tied to resynchronizing after error. Make the operator pause writes and reconcile, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; unobserved side effect remains a separate production risk until observed.

Decision scenarios

Scenario 1: when clock source becomes decisive

Consider a reader whose main constraint is system time used for signing. The correct response is not to infer a universal platform or product winner. It is to monitor NTP offset, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when timestamp format becomes decisive

Consider a reader whose main constraint is seconds, milliseconds or ISO time. It is to test exact serialization, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when validity window becomes decisive

Consider a reader whose main constraint is maximum accepted age. It is to use the narrowest reliable window, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when nonce becomes decisive

Consider a reader whose main constraint is monotonic per-key request value. It is to centralize allocation, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when signature scope becomes decisive

Consider a reader whose main constraint is method, path, body and timestamp. It is to canonicalize once, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when retry becomes decisive

Consider a reader whose main constraint is ambiguous timeout after submission. It is to query state before repeating, retain the evidence, and define a stop condition before funds or permissions are committed.

Sources and editorial method

• Request security — Binance Developers
• REST API authentication — OKX API Docs
• CDP API keys and authentication — Coinbase Developer Platform
• Spot REST authentication — Kraken API Docs