Authentication - Finrock

Finrock uses API keys to authenticate your requests. You can generate them from the dashboard. ⚠️ API keys are shown only once at the time of creation. Be sure to copy and store them securely — they cannot be retrieved later.

🔑 How Authentication Works

Pass your API key in the x-api-key header.
Pass a short-lived JWT signed with your RSA-4096 private key using the Bearer token Authorization header.
No username or password is required — just the API key.
All requests must be made over HTTPS; requests over plain HTTP are rejected.
Invalid or missing keys will return a 401 Unauthorized.

❗️ Keep your API keys secure. They grant full access to your account and should never be shared publicly or within internal tools like Slack or dashboards.

AI connectors such as Claude connect through Finrock sign-in instead. Which endpoints they can call depends on their MCP scopes. See MCP Scopes.

Example Request

POST /dac/v1/transactions HTTP/1.1
Host: api.finrock.io
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
x-api-key: 4466c45a-7b28-4c50-a0f7-198f8d7f34c5

{"asset":"BTC","amount":0.0675,"type":"Withdraw","ts":1715933321398}

Common Authentication Errors

401 Unauthorised — token expired or window too large

The JWT was rejected because either it has already expired, or the exp value is more than 30 seconds ahead of iat. Regenerate the JWT immediately before each request and keep the exp window at 29 seconds or fewer.

401 Unauthorised — invalid signature

The signature on the JWT could not be verified against the public key registered in the control panel. Confirm that you are signing with the private key that corresponds to the public key you uploaded, and that you are using the RS256 algorithm (not HS256 or RS512).

401 Unauthorised — bodyHash mismatch

The hash in the JWT payload does not match the body the server received. Ensure you hash the raw JSON string before passing it to your HTTP client. Avoid pretty-printing or re-ordering keys between hashing and sending.

401 Unauthorised — nonce already used

The nonce value in this JWT has been seen before. Generate a fresh UUID or random string for every request — never cache or reuse a nonce.