Coinbase API Key Authentication in React Native - coinbase-api

Question

I am able to connect to the Coinbase public API without any problem from React Native. I'm trying to get API key authentication working. I think my code looks right but I'm getting a 401 error. I've done the same thing with Bittrex and it worked without issue.
I've mocked up a snippet of code to show the issue...
const key = 'XXXXXXXXXXXXXXXX'
const secret = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
const passphase = 'PASSPHASE'
const method = 'POST';
const timestamp = Date.now() / 1000;
const requestPath = '/orders';
const body = '';
const prehash = timestamp + method + requestPath + body;
const secretBase64 = Buffer(secret, 'base64');
const signed = CryptoJS.HmacSHA512(prehash, key);
const signedBase64 = new
Buffer(signed.toString()).toString('base64');
axios
.put(url, {
timeout: axiosTimeout,
headers: {
'CB-ACCESS-KEY': key,
'CB-ACCESS-SIGN': signedBase64,
'CB-ACCESS-TIMESTAMP': timestamp,
'CB-ACCESS-PASSPHRASE': passphrase
},
debug: true
})
.then(response => {
console.log(response);
})
.catch(error => {
console.log(error.message);
});
});
I created a read-only API key on Coinbase with the permission: wallet:orders:read
I use CryptoJS instead of crypto but that isn't an issue as it works with other exchanges like Bittrex. I converted the signed cypher to Base64 but I think the problem is probably on that line.
Console Log
In the example above I'm not using a valid key, secret or passphrase but using the actual key it doesn't work.
Can anyone see the problem?

Answer 1

I've been following this example on Coinbase:
https://docs.pro.coinbase.com/#api-key-permissions
I know there are some differences between "crypto" and "crypto-js".
I think it should look something like this:
const method = 'POST';
const timestamp = Date.now() / 1000;
const requestPath = url.replace(baseURL, '');
const body = JSON.stringify({
price: '1.0',
size: '1.0',
side: 'buy',
product_id: 'BTC-USD'
});
const prehash = timestamp + method + requestPath + body;
const keyBase64 = Buffer(secret, 'base64');
const signed = CryptoJS.HmacSHA512(prehash, secret).toString(CryptoJS.enc.Base64);
const headers = {
'CB-ACCESS-KEY': keyBase64,
'CB-ACCESS-SIGN': signed,
'CB-ACCESS-TIMESTAMP': timestamp,
'CB-ACCESS-PASSPHRASE': passphrase
}
The pre-hash ('what') in looks like this...
1554714678.037POST/orders{"price":"1.0","size":"1.0","side":"buy","product_id":"BTC-USD"}
The note on Coinbase says that the key needs to base64 decoded but they use the secret in their example. It also says the payload needs to be base64 encoded before adding to the header. I think I've done it all correctly but still getting the error message:
Error: Request failed with status code 401
When I created the API key on Coinbase I have it the correct permission. It provided the key and secret after generation. There was no mention of a passphase. I see in the documentation and in their code example they provide a passphase but what is this for and where should it be defined in Coinbase. Maybe that is the problem.
I have added this to codesandbox.io so it is easier to see what I am talking about... https://codesandbox.io/s/0q93n9vz20