Authentication

{timestamp}{HTTP_METHOD}{full_path_with_query}{raw_body}

1714300000GET/orders/?limit=10

pip install requests solders base58

import hashlib
import hmac
import os
import time

import base58
import requests
from solders.keypair import Keypair

BASE = "https://api.worm.wtf"


def load_keypair(secret: str) -> Keypair:
    """Load a Solana keypair from base58 secret bytes or 128-char hex (full keypair)."""
    s = secret.strip()
    if len(s) == 128 and all(c in "0123456789abcdefABCDEF" for c in s):
        return Keypair.from_bytes(bytes.fromhex(s))
    return Keypair.from_bytes(base58.b58decode(s))


def unwrap(response: requests.Response) -> dict:
    """Return ``data`` from the standard API envelope or raise on error."""
    response.raise_for_status()
    body = response.json()
    err = body.get("error")
    if err is not None:
        raise RuntimeError(err)
    return body["data"]


# --- Bootstrap (one-time): challenge → sign message → create credential ---
keypair = load_keypair(os.environ["WORM_PRIVATE_KEY"])
wallet_address = str(keypair.pubkey())

challenge = unwrap(
    requests.post(
        f"{BASE}/auth/keys/challenge/",
        json={"wallet_address": wallet_address},
        timeout=30,
    )
)
nonce = challenge["nonce"]
message = challenge["message"]

signature = keypair.sign_message(message.encode("utf-8"))
signature_hex = signature.to_bytes().hex()

creds = unwrap(
    requests.post(
        f"{BASE}/auth/keys/create/",
        json={
            "wallet_address": wallet_address,
            "message": message,
            "signature": signature_hex,
            "nonce": nonce,
        },
        timeout=30,
    )
)
API_KEY = creds["api_key"]
API_SECRET = creds["secret"]  # HMAC signing key — use this string as the HMAC secret (UTF-8 bytes)

# --- HMAC-authenticated request ---
timestamp = str(int(time.time()))
method = "GET"
path = "/orders/?limit=10"
body = ""

payload = f"{timestamp}{method}{path}{body}".encode()
worm_signature = hmac.new(API_SECRET.encode(), payload, hashlib.sha256).hexdigest()

resp = requests.get(
    f"{BASE}{path}",
    headers={
        "WORM-API-KEY": API_KEY,
        "WORM-TIMESTAMP": timestamp,
        "WORM-SIGNATURE": worm_signature,
    },
    timeout=30,
)
resp.raise_for_status()