Authentication

Every request to the Rampnow API is authenticated with your API key and an HMAC-SHA256 signature made with your API secret.

Your partner account comes with an API key and secret already created. You can find them in the API Hub of the Partner Dashboard, and regenerate them there if you need to.

Environments

Environment	API base URL	Widget host
Production	`https://api.rampnow.io`	`https://app.rampnow.io`
Sandbox	`https://api.sandbox.rampnow.io`	`https://app.sandbox.rampnow.io`

Keys are environment-scoped: use a sandbox key against the sandbox hosts (*.sandbox.rampnow.io), for both the API and the widget, and a production key against the production hosts. A sandbox key will not work on production hosts, or vice versa.

Request headers

Send these headers on every request, over HTTPS:

Header	Value
`X-RAMPNOW-API-KEY`	Your API key from the Partner Dashboard
`X-RAMPNOW-TIMESTAMP`	Current Unix time in seconds (for example `1772080882`)
`X-RAMPNOW-SIGN`	Hex-encoded HMAC-SHA256 signature of the request. Case-insensitive

Sign a request

Generate the timestamp

Take the current Unix time in seconds, as a string. Use the same string in the header and in the message.

Build the message

Concatenate, with no separators:

The timestamp
The HTTP method in uppercase (GET, POST)
The full request path, starting with /api/partner/v1, plus the query string exactly as you send it (for example /api/partner/v1/ext/ramp_order/blocked_currencies?country=DE)
For POST, PUT and PATCH: the request body, byte for byte as you send it. For GET, nothing.

Sign it

Compute HMAC-SHA256 of the message with your API secret as the key, hex-encode the result and send it in X-RAMPNOW-SIGN.

Your timestamp must be no more than 1 minute old when the request reaches Rampnow. Keep your server clock synchronized with NTP.

Test vector

Use these fixed inputs to check your signing code before you call the API. If your code produces the same signature, it builds the message correctly.

Input	Value
Secret key	`test-secret-key`
Timestamp	`1772080882`
Method	`POST`
Path	`/api/partner/v1/ext/ramp_order/quote`
Body	`{"orderType":"buy","srcAmount":"100","srcCurrency":"EUR","srcChain":"fiat","dstCurrency":"ETH","dstChain":"ethereum"}`

Message to sign (timestamp + method + path + body, no separators):

1772080882POST/api/partner/v1/ext/ramp_order/quote{"orderType":"buy","srcAmount":"100","srcCurrency":"EUR","srcChain":"fiat","dstCurrency":"ETH","dstChain":"ethereum"}

Expected X-RAMPNOW-SIGN:

369afe98d71b99e4121f88643b38956d6bc8c23376426fb2c80b7ba2e6961243

The body is signed byte for byte. A space or a different key order gives a different signature, so always sign the exact string you send.

Code examples

Each example requests a quote. To check your code against the test vector, replace the secret with test-secret-key, the timestamp with 1772080882 and the body with the test vector body: the signature must match.

API_KEY='your-api-key'
API_SECRET='your-api-secret'
BASE_URL='https://api.sandbox.rampnow.io'

# POST: the body is part of the signature
REQ_PATH='/api/partner/v1/ext/ramp_order/quote'
BODY='{"orderType":"buy","srcAmount":"100","srcCurrency":"EUR","srcChain":"fiat","dstCurrency":"ETH","dstChain":"ethereum"}'
TS=$(date +%s)
SIGN=$(printf '%s' "${TS}POST${REQ_PATH}${BODY}" \
  | openssl dgst -sha256 -hmac "$API_SECRET" | awk '{print $NF}')

curl --request POST "${BASE_URL}${REQ_PATH}" \
  --header 'Content-Type: application/json' \
  --header "X-RAMPNOW-API-KEY: ${API_KEY}" \
  --header "X-RAMPNOW-TIMESTAMP: ${TS}" \
  --header "X-RAMPNOW-SIGN: ${SIGN}" \
  --data "$BODY"

# GET: no body in the signature; the query string is included as sent
REQ_PATH='/api/partner/v1/ext/ramp_order/your-order-1001'
TS=$(date +%s)
SIGN=$(printf '%s' "${TS}GET${REQ_PATH}" \
  | openssl dgst -sha256 -hmac "$API_SECRET" | awk '{print $NF}')

curl --request GET "${BASE_URL}${REQ_PATH}" \
  --header "X-RAMPNOW-API-KEY: ${API_KEY}" \
  --header "X-RAMPNOW-TIMESTAMP: ${TS}" \
  --header "X-RAMPNOW-SIGN: ${SIGN}"

import hashlib
import hmac
import json
import time

import requests

API_KEY = "your-api-key"
API_SECRET = "your-api-secret"
BASE_URL = "https://api.sandbox.rampnow.io"
PATH = "/api/partner/v1/ext/ramp_order/quote"

body = json.dumps(
    {
        "orderType": "buy",
        "srcAmount": "100",
        "srcCurrency": "EUR",
        "srcChain": "fiat",
        "dstCurrency": "ETH",
        "dstChain": "ethereum",
    },
    separators=(",", ":"),
)

timestamp = str(int(time.time()))
message = timestamp + "POST" + PATH + body
signature = hmac.new(API_SECRET.encode(), message.encode(), hashlib.sha256).hexdigest()

response = requests.post(
    BASE_URL + PATH,
    headers={
        "Content-Type": "application/json",
        "X-RAMPNOW-API-KEY": API_KEY,
        "X-RAMPNOW-TIMESTAMP": timestamp,
        "X-RAMPNOW-SIGN": signature,
    },
    data=body,  # send the exact string you signed, not json=
)
print(response.status_code, response.text)

const crypto = require("crypto");

const API_KEY = "your-api-key";
const API_SECRET = "your-api-secret";
const BASE_URL = "https://api.sandbox.rampnow.io";
const PATH = "/api/partner/v1/ext/ramp_order/quote";

const body = JSON.stringify({
  orderType: "buy",
  srcAmount: "100",
  srcCurrency: "EUR",
  srcChain: "fiat",
  dstCurrency: "ETH",
  dstChain: "ethereum",
});

const timestamp = String(Math.floor(Date.now() / 1000)); // seconds, not milliseconds
const signature = crypto
  .createHmac("sha256", API_SECRET)
  .update(timestamp + "POST" + PATH + body)
  .digest("hex");

fetch(BASE_URL + PATH, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RAMPNOW-API-KEY": API_KEY,
    "X-RAMPNOW-TIMESTAMP": timestamp,
    "X-RAMPNOW-SIGN": signature,
  },
  body, // send the exact string you signed
})
  .then(async (res) => console.log(res.status, await res.text()))
  .catch(console.error);

package main

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"net/http"
	"strconv"
	"time"
)

func main() {
	apiKey := "your-api-key"
	apiSecret := "your-api-secret"
	baseURL := "https://api.sandbox.rampnow.io"
	path := "/api/partner/v1/ext/ramp_order/quote"

	body := `{"orderType":"buy","srcAmount":"100","srcCurrency":"EUR","srcChain":"fiat","dstCurrency":"ETH","dstChain":"ethereum"}`

	timestamp := strconv.FormatInt(time.Now().Unix(), 10)
	mac := hmac.New(sha256.New, []byte(apiSecret))
	mac.Write([]byte(timestamp + "POST" + path + body))
	signature := hex.EncodeToString(mac.Sum(nil))

	req, err := http.NewRequest(http.MethodPost, baseURL+path, bytes.NewBufferString(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-RAMPNOW-API-KEY", apiKey)
	req.Header.Set("X-RAMPNOW-TIMESTAMP", timestamp)
	req.Header.Set("X-RAMPNOW-SIGN", signature)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	respBody, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(respBody))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class RampnowApi {
    public static void main(String[] args) throws Exception {
        String apiKey = "your-api-key";
        String apiSecret = "your-api-secret";
        String baseUrl = "https://api.sandbox.rampnow.io";
        String path = "/api/partner/v1/ext/ramp_order/quote";

        String body = "{\"orderType\":\"buy\",\"srcAmount\":\"100\",\"srcCurrency\":\"EUR\","
            + "\"srcChain\":\"fiat\",\"dstCurrency\":\"ETH\",\"dstChain\":\"ethereum\"}";

        String timestamp = String.valueOf(Instant.now().getEpochSecond());
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(apiSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] digest = mac.doFinal((timestamp + "POST" + path + body).getBytes(StandardCharsets.UTF_8));
        String signature = HexFormat.of().formatHex(digest);

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + path))
            .header("Content-Type", "application/json")
            .header("X-RAMPNOW-API-KEY", apiKey)
            .header("X-RAMPNOW-TIMESTAMP", timestamp)
            .header("X-RAMPNOW-SIGN", signature)
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

Troubleshooting

Every authentication failure returns HTTP 401 with code 100002 and message not_authorized_err, without a displayError. The response doesn’t say which check failed, so work through this table:

Symptom	Likely cause	Fix
Every request fails	Sandbox key against production hosts, or the reverse	Match the key to the environment
Every request fails	API key copied wrong, or the key was regenerated	Copy the current key and secret from the API Hub
Every request fails	`X-RAMPNOW-TIMESTAMP` missing or not an integer	Send whole Unix seconds as a string, for example `1772080882`
Fails intermittently or after a delay	Timestamp more than 1 minute old: clock drift, or a request built and sent later	Sync your clock with NTP; generate the timestamp just before sending
Your signature doesn’t match the test vector	Wrong secret, or message parts in the wrong order	Message is `timestamp + METHOD + path + body`, no separators
Works for `GET` without a query, fails with one	Query string signed differently from how it was sent (re-encoded or re-ordered)	Sign the query exactly as it appears in the request URL
Fails for every path	Path signed without the `/api/partner/v1` prefix, or with the host	Sign the path only, starting with `/api/partner/v1`
`POST` fails, `GET` works	Signed body differs from the bytes sent: the HTTP client re-serialized the JSON or added whitespace	Serialize once and send that exact string (for example `data=` in Python, not `json=`)
`GET` fails, `POST` works	A body (even `{}`) was included in the signature for a `GET`	Sign no body for `GET`

Uppercase and lowercase hex signatures are both accepted.

Quick reference

Component	Rule
Secret	Your API secret from the API Hub
Timestamp	Unix seconds; no more than 1 minute old
Method	Uppercase (`GET`, `POST`)
Path	Starts with `/api/partner/v1`; includes the query string exactly as sent
Body	`POST`/`PUT`/`PATCH`: exact bytes sent. `GET`: nothing
Signature	HMAC-SHA256, hex-encoded

About API

Onramp & Offramp Intent

Configuration

Webhooks

Environments

Request headers

Sign a request

Test vector

Code examples

Troubleshooting

Quick reference

​Environments

​Request headers

​Sign a request

​Test vector

​Code examples

​Troubleshooting

​Quick reference

Environments

Request headers

Sign a request

Test vector

Code examples

Troubleshooting

Quick reference