Authentication Methods

StraitsX supports two authentication methods for securing your API requests. Both methods require the X-XFERS-APP-API-KEY header, which identifies your business account.

🚧

Securing your API Keys

Your API keys and private keys carry many privileges, so be sure to keep them secure! Do not share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth.

Method 1: API Key Authentication (Default)

This is a token-based authentication method where your API key acts as a bearer token to identify and authorize your application. Each API request is authenticated by including your API key in the request header — no additional signing or cryptographic steps are required.

All accounts have an app key for both Sandbox and Production environments. You can retrieve them from the locations below:

This method is suitable for most integrations and requires no additional setup beyond generating your API key from the StraitsX Dashboard.

Method 2: HTTP Request Signing (Optional)

HTTP Request Signing is an enhanced authentication option that uses asymmetric cryptography (public/private key pairs) to sign each API request. This provides stronger security guarantees on top of your API key.

In addition to the X-XFERS-APP-API-KEY, the following headers are required when HTTP Request Signing is enabled:

📘

For detailed implementation steps, including how to construct the canonical string and code samples, refer to the HTTP Request Signing FAQ section.

Getting Started with HTTP Request Signing:

1. Keep your private.pem safe on your server — never share or expose it.
2. Upload your public.pem to the StraitsX Dashboard under the Public Key management section.
3. Test your signing flow in the Sandbox environment before enabling it in Production.

Security Best Practices

These practices apply to all authentication methods — whether you are using API Key Authentication or HTTP Request Signing.