Indodax API Documentation

The Deadman Switch is a safety mechanism designed to automatically cancel all open orders for specified trading pairs if your system experiences an outage.

To use it effectively, you must call the endpoint repeatedly as a 'heartbeat'. Each successful call resets the countdown timer. For example, if you call the endpoint every 30 seconds with a countdownTime of 120,000ms (120s), your orders remain safe. If your system fails and the endpoint isn't called within 120 seconds, Indodax will automatically cancel all open orders for those pairs.

Key details:

• Resetting: Calling the endpoint with a new countdownTime replaces the existing timer.
• Stopping: Calling the endpoint with a countdownTime of 0 stops the countdown timer entirely.
• Precision: The system checks countdowns approximately every 10 milliseconds. Do not set the countdown time to be too precise or too small; ensure sufficient redundancy.
• Rate Limit: 10 requests per 10 seconds per IP.

For TRADE and USER_DATA endpoints, you must sign your request.

1. Headers: Pass your API key in the X-APIKEY header. The signature can be passed in the Sign request header, as a signature field in the request body, or as a signature query parameter.
2. Signature Construction: Concatenate the query string and the request body (if any). Encrypt this string using HMAC-SHA256 with your secretKey.
3. Timing: Include a timestamp (milliseconds). The server will reject the request if timestamp < serverTime - recvWindow or if the request is too far in the future.

Note: X-APIKEY and secretKey are case-sensitive, but the signature value itself is not case-sensitive.

if (( timestamp >= serverTime + 1000 || serverTime - timestamp > recvWindow )); then
    # Reject request
    echo "Request rejected"
else
    # Process request
    echo "Request processed"
fi

All TAPI v2 requests must include either a nonce or a timestamp to be valid. If both are provided, the timestamp takes precedence.

• nonce: An incrementing integer. It must be greater than the nonce used in the previous request (e.g., if the last nonce was 1000, the next must be 1001 or higher).
• timestamp: A millisecond timestamp representing when the request was generated.
• recvWindow (optional): A validity window in milliseconds. It defines how long after the timestamp the request remains valid. The default is 5000 ms.

| **Parameter** | **Mandatory** | **Description** | **Value** |
| --- | --- | --- | --- |
| `nonce` | yes | An increment integer. | Must be greater than the nonce of the last request. |
| `timestamp` | yes | Millisecond timestamp when the request was generated. | Timestamp in milliseconds (ms) |
| `recvWindow` | no | Validity window for request in milliseconds (ms). | Default: `5000 ms` |

Private WebSocket tokens are valid for only 24 hours. You must request a new token each time you connect and continue to request them regularly to maintain connectivity.

To request a token, perform a POST request to https://indodax.com/api/private_ws/v1/generate_token with the following requirements:

• Body: client=tapi&tapi_key=<your_tapi_key> (Content-Type: application/x-www-form-urlencoded)
• Header: Sign must contain an HMAC-SHA512 signature of the request body using your tapi_secret as the key.

The response contains connToken and channel which are required for the WebSocket connection.

// JavaScript implementation for requesting a token
const crypto = require("crypto");

function generateHMAC(requestBody, secret) {
  const key = Buffer.from(secret, "utf-8");
  const hmac = crypto.createHmac("sha512", key);
  hmac.update(requestBody, "utf-8");
  return hmac.digest("hex");
}

async function RequestToken() {
  const url = "https://indodax.com/api/private_ws/v1/generate_token";
  const secret = <tapi_secret>;
  const key = <tapi_key>;

  const requestBody = `client=tapi&tapi_key=${key}`;
  const sign = generateHMAC(requestBody, secret);

  const opt = {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      "Sign": sign,
    },
    body: requestBody,
  };

  const response = await fetch(url, opt);
  const responseData = await response.json();
  return responseData;
}

RequestToken().then((data) => {
  console.log("token:", data.return.connToken);
  console.log("channel:", data.return.channel);
});