Coin OpenAPI

Development & Testing ​

Critical notes (must read) ​

  • If you see a non-200 HTTP status, request timeout, connection drop, or a non-success body status and cannot confirm whether the business was accepted, decide carefully whether to resubmit. Do not blindly retry before verifying the result.
  • For fund-moving endpoints (e.g. exchange confirm, withdraw create), under network anomalies the server may already have accepted and continued (payment in progress). Resubmitting can cause duplicate orders / duplicate payouts and fund loss.
  • Recommendation: enforce idempotency with merchant-side trade_sn on write APIs. On timeout or uncertain results, call the matching query API first; resubmit only after confirming the order was not created successfully.

Test configuration ​

Test base URL: https://coin-api-test.adox.group (dev/test; paths remain /coin/v1/*)

Test merchant ID: M1781678976331286876 (skips IP whitelist; in production upload an EC P-256 public key in the merchant console)

Merchant private key (for request signing, PKCS#8):

text
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgvM9J/kTRqV4JutlF
hWs1YeaqaPfvK+g3vAFA0dlETzWhRANCAATxBWYlmz1cF4qTHGzF/B9zJM2LzLLI
AQj3m7bO+ZAQ7+YWevRRv98lJNGXuDnqu4jp0Gq0vveZkqAc1jYo2yhV
-----END PRIVATE KEY-----

Merchant public key:

text
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8QVmJZs9XBeKkxxsxfwfcyTNi8yy
yAEI95u2zvmQEO/mFnr0Ub/fJSTRl7g56ruI6dBqtL73mZKgHNY2KNsoVQ==
-----END PUBLIC KEY-----

Sign self-check ​

Not a production business API — for signature comparison only. Available only in the test environment for the test merchant. Other merchants / production return unauthorized.

See Sign Self-Check.

Practical tips ​

  • In the test environment, call POST /coin/v1/test/sign first with the test merchant: compare digest / sign_string; check is_verify (do not string-compare the request signature with the returned sign). Unavailable in production and for other merchants.
  • Compute Digest over the exact raw body bytes that will be sent; do not re-serialize.
  • Canonical String: exactly one space after the colon; LF line breaks.
  • After generating Authorization, do not change X-Timestamp / X-Nonce / Body.
  • quote_id expires quickly (system quote expires_in is typically 5 seconds); confirm before expiry.
  • Currency fields must be uppercase; amount precision is in Currency.
  • Log raw request, Canonical String, and raw response for troubleshooting.