Overview

This document is the consolidated, live-verified API reference for the Koinbay spot and futures REST APIs plus the market WebSocket.

Live hosts

Surface	Base URL
Spot REST	https://openapi.koinbay.com
Futures REST	https://futuresopenapi.koinbay.com
Spot WebSocket	wss://ws.koinbay.com/kline-api/ws
Futures WebSocket	wss://futuresws.koinbay.com/kline-api/ws

Authentication & signing

Trade and account endpoints require three headers:

Header	Value
X-CH-APIKEY	Your API key
X-CH-TS	Request timestamp, Unix epoch MILLISECONDS
X-CH-SIGN	HMAC-SHA256 signature, LOWERCASE HEX

The signature is computed over the pre-hash string:

timestamp + METHOD + requestPath [+ "?" + queryString] [+ body]

• METHOD is uppercase (GET / POST).

• For GET with query params, append `?` + the exact query string.

• For POST, append the exact JSON body string you send.

• HMAC key = your API secret. Output = hex.

• recvWindow (default 5000ms) bounds clock skew. Content-Type is always application/json.

Three distinct error envelopes (all confirmed live — clients must handle all three):

• Spot business error: `{"code": <int>, "msg": <str>}`

• Futures business error: `{"code": "<str>", "succ": false, "msgData": null, "msg": <str>}` (string code).

• Infrastructure / 404: `{"timestamp","status","error","message","path"}` (Spring-style) — returned by paths that don't exist.

Order-ID precision warning: orderId values exceed 2^53, so 64-bit-float JSON parsers (e.g. JavaScript JSON.parse) silently corrupt them. Always use the string form — spot returns orderId (number) AND orderIdString (string); futures POST /order and POST /cancel return orderId as a string. Treat all order IDs as strings.