Skip to main content

Why does the API say "Project requires signature authentication"?

Your project uses Signature Based auth, so a request without both signature headers is refused until you sign it or switch the project to API Key Only.

Your project uses Signature Based authentication, but the request was missing x-signature, x-nonce or both (HTTP 401). The New Project form preselects Signature Based (Recommended); key-only requests need an API Key Only project. The Projects page shows each project's auth method.

Two fixes:

  • Sign every request: add x-nonce (a Unix timestamp or random integer) and x-signature (the HMAC-SHA256 of your API secret plus the nonce, keyed with your API key, as a hex string), both new for each request. A wrong signature gives Project authorization is not valid. See Signature authentication.

  • Switch the project to API Key Only in its settings. The API key and secret stay the same.

Use Signature Based for calls from a browser or your users' devices. API Key Only suits your own backend, where the key must stay, because it alone authorizes requests.

Details: How do I make my first API request? and How do I get an API key?

Related Articles
Did this answer your question?