Authentication

Overview

Every request to the Onboard Business API must include your API key and an HMAC-SHA256 request signature — there is no unsigned tier.

x-api-key: <your-api-key>

API keys used to call cash payment or crypto transfer endpoints must have IP whitelisting configured in the Business Dashboard. Requests from an unlisted IP are rejected. See Getting API Credentials.

Signing a request

Required headers for signed requests:

Header	Description
`x-api-key`	Your API key, from the Business Dashboard
`x-signature`	HMAC-SHA256 signature of the request
`x-timestamp`	Unix timestamp (seconds) when the signature was generated

The signature is computed over the timestamp and the exact JSON body you send, joined with &:

const crypto = require('crypto');

const timestamp = Math.ceil(Date.now() / 1000);
const apiSecret = '<your Onboard Business API secret>'; // from the Business Dashboard
const requestBody = { /* the exact JSON body of your request; {} for GET requests */ };

const signaturePayload = `t=${timestamp}&${JSON.stringify(requestBody)}`;
const signature = crypto
  .createHmac('sha256', apiSecret)
  .update(signaturePayload)
  .digest('hex');

Include the computed values in your request headers:

x-api-key: <your-api-key>
x-signature: <computed-signature>
x-timestamp: <epoch-timestamp>

Your timestamp must be within 30 seconds of the current time — if requests are unexpectedly rejected, check for clock drift on the machine generating the signature.

Unauthorized requests return a 401 status, whether the cause is a missing/invalid x-api-key or an invalid/expired signature. For example, a skewed timestamp returns:

{
  "code": "UNAUTHENTICATED",
  "message": "Request timestamp is skewed beyond 30 seconds"
}

Check the message field for the specific error.

Info

Virtual Account

Virtual Account Number

Stablecoin Deposits & Withdrawal

Crypto Beneficiaries

Fiat Beneficiaries

Cash Deposits

Cash Payouts

Offramp Accounts

Transaction Activities

WebHook Events

Authentication

Overview

Signing a request

​Overview

​Signing a request

Overview

Signing a request