1

I am getting a 403 error so I know it probably has to do with authentication, but I just can't seem to figure it out. I've been pretty much following the directions on the website https://bitbucket.org/nitrous/mtgox-api/overview, but to no avail. As far as I know, the protocol are:

  1. take the path of your request (which should look something like BTCUSE/money/info or something) followed by the null character \0, followed by your post parameters, and combine them into a string.
  2. decode the secret key from base 64
  3. using hmac sha512, the above string as the message, and the secret key as the secret key, run the hmac algorithm to come up with the signature.
  4. encode this whole thing back to base64

so at this stage, I have

params:  "nonce=1375719059438000"
message: "BTCUSD/money/info nonce=1375719059438000"

So I am just trying to make an info call, which doesn't require any parameters besides the nonce. So as the documentation says, I set the request property "rest-key" to my apikey and "rest-sign" to my signature, and then complete the post. but I'm getting a 403 response. A couple question I have from this website and that I've seen in the forums but never got answered are

  1. what is the deal with using urlencode on the post parameters? Do I need to do that? He does it and its in all the examples I've seen, but I've never seen anything that says you have to do this, and
  2. is my null character correct? Because I've followed the directions but in the example on the page I just gave, his message string still has the \0 in it, which I would lead me to believe he is actually escaping the \ by putting \\0 in the string, not \0. Any ideas? Let me know if you think it would be better to just post my code on stack overflow.

Here is my code for making the request:

    public String queryMtGox(String method, HashMap<String, String> args) throws    
    IllegalStateException{
            String path = "BTCUSD/money/" + method;
    try {
    String nonce =  String.valueOf(System.currentTimeMillis())+"000";
        String post_data = this.buildMtGoxQueryString(args);
        if (post_data.contentEquals("")){
            post_data+="nonce="+nonce;
        }else post_data+="&nonce="+nonce;
        String message = path +"\0"+post_data;
        // args signature
        Mac mac = Mac.getInstance("HmacSHA512");
        SecretKeySpec secret_spec = new           
    SecretKeySpec(Base64.decodeBase64(this.goxsecret), "HmacSHA512");
        mac.init(secret_spec);
        String signature = Base64.encodeBase64String(mac.doFinal(message.getBytes()));

        // build URL
        URL queryUrl = new URL("https://data.mtgox.com/api/2/" + path);

        // create connection
        HttpsURLConnection connection = (HttpsURLConnection)queryUrl.openConnection();
        connection.setDoOutput(true);
        connection.setDoInput(true);

        connection.setRequestMethod("POST");

        connection.setRequestProperty("Rest-Key", this.goxkey);
        connection.setRequestProperty("User-Agent", "Mozilla/4.0 (compatible; 
    MtGoxTradeCLI)");
        connection.setRequestProperty("Content-Type","application/x-www-form-
    urlencoded");
        connection.setRequestProperty("Rest-Sign", signature.replaceAll("\n", ""));

        // write post
         DataOutputStream outdata = new DataOutputStream(connection.getOutputStream());
                 outdata.write(post_data.getBytes());
                 outdata.close();
                 connection.disconnect();
        int len;
        // read inf

        byte buffer[] = new byte[16384];

         len = connection.getInputStream().read(buffer, 0, 16384);

        System.out.print(new String(buffer, 0, len, "UTF-8"));
    } catch (Exception ex) {
        Logger.getLogger(Client.class.getName()).log(Level.SEVERE, null, ex);
    }
    return "foo";
    }

I am getting an error at the getInputStream() of course.

Jim Garrison
  • 85,615
  • 20
  • 155
  • 190
Paul
  • 1,106
  • 1
  • 16
  • 39
  • I would just like to comment that in this example, originally I was adding the nonce to the postdata after it had been urlencoded. I changed it so that the nonce is added before the urlencode, though this does not change the result because the nonce is the only paramete, so all characters are alphanumeric anyways. – Paul Aug 06 '13 at 21:22
  • This is the same process (albeit with C#) that I'm following with the same 403 error. I did find the GET call to money/ticker_fast does work however. (as an aside I do set the Rest-key and Rest-sign headers in that request too). – misteraidan Dec 10 '13 at 10:22

0 Answers0