Domain & Authentication & APPID

Domain & Authentication & APPID

1. API Domain

https://openapi.trustformer.info

All V3 API endpoints are prefixed with this domain.

2. Authentication Mechanism

KYT will provide each client with:

• apikey
• secret

When calling any API:

• apikey must be passed as a request parameter.
• timestamp and sign must be included in the request header.

3. Signature Algorithm

The signature is calculated using the following rule:

sha256("timestamp={timestamp}&secret={secret}")

Example

Before encryption:

timestamp=1677148682&secret=9e3df800bbcbb1b8fc97bf78ed95a95a92aa3a155d270f1e48eb330c2d435321

After SHA256 encryption:

110a20dcbe1fef5456051a8887c8d1aeba637bbc624e606697fb82a7e7ded604

You may use any SHA256 tool or library to generate the signature.

4. Request Header Parameters

5. APP_ID Usage

app_id is used to distinguish different business applications under the same client.

It must be passed as a required parameter in all V3 business APIs.

Each app_id:

• Corresponds to a specific application
• Has independent risk strategy configuration
• Has independent risk monitoring records

6. Authentication Failure Response

If the API key is invalid or expired, the interface returns:

{
  "code": -1,
  "data": {},
  "message": "api_key is invalid"
}

7. Notes

• The timestamp must be the current server time (in seconds).
• It is recommended to keep the time difference within ±5 minutes.
• Requests with invalid signatures will be rejected.
• Keep your secret strictly confidential.