🔐Authentication

To use the AllCore API you need to get an API id and secret keys.

Following steps explain how to get API token:

1. Sign up or log into AllCore's app.

2. Navigate to user profile and pass KYC process.

3. Ask your personal manager to get access to the API.

4. On the API tokens page click "Add API token".

5. Fill in the form on the modal window and click "Create API token".

6. After that you will be provided with "Token Id" and "Token Secret".

7. Now you all set! Please store the keys securely. If the credentials were compormised you can revoke it at any time on the same page.

API Tokens in action

Below you can find the request headers which are used for the token-based authentication:

Simple approach:

X-Token-API-Id - Identifier of the token (started with TKN- prefix)
X-Token-API-Secret - Token secret

HmacSHA256:

X-Token-API-Id - Identifier of the token (started with TKN- prefix)
X-HMAC-SHA256-Signature - HMAC Signature
X-Salt - Salt (nonce)

Signature = HmacSHA256 function of (Request body + salt) hashed by token secret in HEX

For GET request just use "" as a body parameter

Python Example

Here is an example of how to get a balance with the signature of the request in python

Secret token GET example

import requests

id = 'TKN-5c1296b8-6929-443b-ac06-f732e0e27be5'
secret = "dBajIp3wHnw2euxohPiZvsCEorG3Fhl9gsHl2UIBlsImHjWRdSJdp4Gh6e3y2PNs"


headers = {}
headers['X-Token-API-Id'] = id
headers['X-Token-API-Secret'] = secret


url = 'https://api.allcore.io/v1/user/wallet/balances'

http_response = requests.get(url=url, headers=headers)


print(str(http_response.content.decode()))

HmacSHA256 GET example

import hashlib
import hmac
import requests
import secrets

base_url = 'https://api.allcore.io'
token_id = "TKN-5c1296b8-6929-443b-ac06-f732e0e27be5"
token_secret = "dBajIp3wHnw2euxohPiZvsCEorG3Fhl9gsHl2UIBlsImHjWRdSJdp4Gh6e3y2PNs"
salt = secrets.token_hex(32)

data = ''
data_s = data + salt

dig = hmac.new(token_secret.encode('utf-8'), msg=data_s.encode('utf-8'),
digestmod=hashlib.sha256).digest()

signature = dig.hex()


headers = {'X-Token-API-Id': token_id,
         'X-HMAC-SHA256-Signature': signature,
         'X-Salt': salt}

url = base_url + '/v1/user/wallet/balances'

http_response = requests.get(url=url, headers=headers)

HmacSHA256 POST example

import hashlib
import hmac
import requests
import secrets
import json

base_url = 'https://api.allcore.io'
token_id = "TKN-5c1296b8-6929-443b-ac06-f732e0e27be5"
token_secret = "dBajIp3wHnw2euxohPiZvsCEorG3Fhl9gsHl2UIBlsImHjWRdSJdp4Gh6e3y2PNs"
salt = secrets.token_hex(32)

data = {"amount": 50, "cardNumber": "5555555555554444", "firstName": "John",
        "lastName": "Doe", "phoneNumber": "[phone]",
        "method": "CC_VISAMC", "currency": "USD"}
data_s = json.dumps(data) + salt
dig = hmac.new(token_secret.encode('utf-8'), msg=data_s.encode('utf-8'),
               digestmod=hashlib.sha256).digest()

signature = dig.hex()

headers = {
    'X-Token-API-Id': token_id,
    'X-HMAC-SHA256-Signature': signature,
    'X-Salt': salt
}

url = base_url + '/v1/user/payments/payout'

http_response = requests.post(url=url, headers=headers, json=data)