Skip to main content
This quickstart is for the Bitnob Business API. If you want to hold keys yourself, use the Bitnob Enterprise API quickstart instead. Every Bitnob Business API request is HMAC-signed, so the first milestone of any integration is one authenticated call. This page gets you from credentials to a 200 from /api/whoami in about five minutes. Everything else in the docs builds on the signing helper you set up here.

​
Prerequisites

You need the CLIENT_ID and CLIENT_SECRET you issued on the previous page, Set up your account. The secret is shown once, so keep it out of source control and out of client-side code.
1

Load your credentials

Keep credentials in the environment, not in source:
2

Sign a request

Every request carries four headers: X-Auth-Client, X-Auth-Timestamp, X-Auth-Nonce, and X-Auth-Signature, an HMAC-SHA256 over CLIENT_ID:TIMESTAMP:NONCE:PAYLOAD. For a GET request the payload is an empty string.
A 200 with your company details means your credentials and signing are correct. That is the whole milestone.For application code, take a ready-made signing helper in Node.js, Go, or Python from Authentication rather than hand-rolling one.
3

If you got a 401 instead

These causes cover nearly every failure:
  • The timestamp is in milliseconds; the API wants seconds.
  • The signed body does not byte-for-byte match the sent body; for GET, sign an empty string.
  • A header is missing or the secret is wrong.
  • Your .env file was saved with Windows line endings, which leave a hidden \r on the end of CLIENT_ID or CLIENT_SECRET. Save it with LF line endings, or strip the \r when you load it.
See the troubleshooting notes on Authentication.
4

Make your first real call

With signing working, everything is open. Two good next calls:
Then pick your product path below.

​
Build something

Send your first payout

Quote, beneficiary, finalize, funded, delivered.

Accept USDT and settle in naira

Receive on-chain, settle to a bank account.

Issue your first card

A funded USD Visa card, end to end.

Swap bitcoin to USDT

Quote and execute a conversion.

​
Next

Webhooks and event handling

Verify, de-duplicate, and retry the events every product sends.

Core concepts

The model every product shares.