> ## Documentation Index
> Fetch the complete documentation index at: https://www.bitnob.dev/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Bitnob API requests authenticate with an `X-Auth-Client` API key header against https://api.bitnob.com.
> Always use the sandbox environment for testing. Never put live API keys in sample code.
> Money amounts are integers in the smallest unit of the currency (satoshis for BTC, cents for fiat). Never use floats.
> Every state-changing request takes a client-supplied `reference` and must be treated as idempotent on retry.
> Quotes expire. Re-quote rather than reusing a stale quote id.

# Bitnob Business API quickstart

> Your first signed request in five minutes: load your credentials, build the four HMAC headers, and get a 200 back from /api/whoami.

This quickstart is for the **Bitnob Business API**. If you want to hold keys yourself, use the [Bitnob Enterprise API quickstart](https://www.bitnob.dev/docs/platform/quickstart.md) instead.

Every Bitnob Business API request is HMAC-signed, so the first milestone of any integration is one authenticated call. This page gets you from credentials to a `200` from `/api/whoami` in about five minutes. Everything else in the docs builds on the signing helper you set up here.

## Prerequisites

You need the `CLIENT_ID` and `CLIENT_SECRET` you issued on the previous page, [Set up your account](https://www.bitnob.dev/docs/getting-started/account-setup.md). The secret is shown once, so keep it out of source control and out of client-side code.

**1. Load your credentials**

Keep credentials in the environment, not in source:

```bash theme={null}
export CLIENT_ID=yourClientId
export CLIENT_SECRET=yourSecretKey
```

**2. Sign a request**

Every request carries four headers: `X-Auth-Client`, `X-Auth-Timestamp`, `X-Auth-Nonce`, and `X-Auth-Signature`, an HMAC-SHA256 over `CLIENT_ID:TIMESTAMP:NONCE:PAYLOAD`. For a GET request the payload is an empty string.

```bash theme={null}
CLIENT_ID="${CLIENT_ID}"
CLIENT_SECRET="${CLIENT_SECRET}"
TIMESTAMP=$(date +%s)
NONCE=$(openssl rand -hex 16)

PAYLOAD="${CLIENT_ID}:${TIMESTAMP}:${NONCE}:"
SIGNATURE=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$CLIENT_SECRET" -hex | awk '{print $2}')

curl -s "https://api.bitnob.com/api/whoami" \
  -H "X-Auth-Client: ${CLIENT_ID}" \
  -H "X-Auth-Timestamp: ${TIMESTAMP}" \
  -H "X-Auth-Nonce: ${NONCE}" \
  -H "X-Auth-Signature: ${SIGNATURE}"
```

A `200` with your company details means your credentials and signing are correct. That is the whole milestone.

For application code, take a ready-made signing helper in Node.js, Go, or Python from [Authentication](https://www.bitnob.dev/api-reference/authentication/authentication.md) rather than hand-rolling one.

**3. If you got a 401 instead**

These causes cover nearly every failure:

* The timestamp is in milliseconds; the API wants seconds.
* The signed body does not byte-for-byte match the sent body; for GET, sign an empty string.
* A header is missing or the secret is wrong.
* Your `.env` file was saved with Windows line endings, which leave a hidden `\r` on the end of `CLIENT_ID` or `CLIENT_SECRET`. Save it with LF line endings, or strip the `\r` when you load it.

See the troubleshooting notes on [Authentication](https://www.bitnob.dev/api-reference/authentication/authentication.md).

**4. Make your first real call**

With signing working, everything is open. Two good next calls:

```bash theme={null}
GET /api/balances        # your balances by currency
GET /api/transactions    # recent activity
```

Then pick your product path below.

## Build something

> [card] [Send your first payout](https://www.bitnob.dev/docs/payouts/send-your-first-payout.md)
>
> Quote, beneficiary, finalize, funded, delivered.

> [card] [Accept USDT and settle in naira](https://www.bitnob.dev/docs/stablecoins/accept-usdt-and-settle-in-naira.md)
>
> Receive on-chain, settle to a bank account.

> [card] [Issue your first card](https://www.bitnob.dev/docs/card-issuing/issue-your-first-card.md)
>
> A funded USD Visa card, end to end.

> [card] [Swap bitcoin to USDT](https://www.bitnob.dev/docs/trading/swap-bitcoin-to-usdt.md)
>
> Quote and execute a conversion.

## Next

> [card] [Webhooks and event handling](https://www.bitnob.dev/docs/getting-started/api-best-practices/webhook-best-practices.md)
>
> Verify, de-duplicate, and retry the events every product sends.

> [card] [Core concepts](https://www.bitnob.dev/docs/getting-started/core-concepts-and-architecture.md)
>
> The model every product shares.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.