Secrets & Signing

Store secrets safely and let the SDK generate signed request fields.

Signing rule

Signed requests exclude sign, omit empty values, sort fields by ASCII key order, join fields as k=v&k2=v2, and calculate HMAC-SHA256 hex with apiSecret.

SDK-managed fields

Field	Source	Description
agentCode	SDK config	Partner agent code.
timestamp	Current server time	Unix timestamp in seconds.
nonce	Secure random value	Replay-protection random string.
sign	HMAC-SHA256	Request signature.
currency	Default currency	Used when transfer/account APIs omit currency.