Developer API

Build with Nonlogs

Read live markets and order books publicly, or use a signed API key to place and manage limit orders.

Manage API keys

Trading only

API keys cannot deposit, withdraw, change security settings, or access administrator functions.

Overview

Base URL https://nonlogs.io

Format application/json

Authentication HMAC-SHA256

Standard limit 5/sec · 300/min

No key required

Public market data

GET/api/markets

Returns prices, 24-hour volume, high/low, best bid, and best ask for every active market.

{"markets":{"BTC-USDT":{"last_price":"68124.12000000","high_24h":"69400.00000000","low_24h":"67250.00000000","base_volume":"12.34000000","quote_volume":"840000.000000","lowest_ask":"68130.00000000","highest_bid":"68120.00000000","percent_change":1.24}}}

GET/api/markets/{pair}

Returns the same ticker fields for one pair, such as BTC-USDT.

GET/pair/pairs?skip=0&limit=100

Lists active pairs and their base/quote asset metadata. The maximum limit is 100.

GET/pair/pairs/{pair}

Returns metadata and supported decimal precision for one active pair.

GET/order/orderbook/{pair}?depth=20

Returns aggregated bids and asks as [price, quantity] string tuples. Depth may be 1–100.

{"pair":"BTC-USDT","timestamp":"2026-08-08T08:00:00Z","bids":[["68120.00000000","0.25000000"]],"asks":[["68130.00000000","0.10000000"]]}

Signed requests

Authentication

Send all four headers below. Timestamps must be within 30 seconds of server time and every hexadecimal nonce may be used only once.

Header	Value
`X-API-Key`	Your public API key
`X-Timestamp`	Unix timestamp in seconds
`X-Nonce`	Unique hexadecimal string, 16–128 characters
`X-Signature`	Lowercase HMAC-SHA256 hexadecimal digest

Canonical payload

METHOD
PATH
TIMESTAMP
NONCE
SORTED_QUERY
BODY

Use the uppercase method, path beginning with /, query parameters sorted by key and RFC 3986 encoded, and the exact raw JSON body. Use an empty line when query or body is absent. The signature is hex(HMAC_SHA256(api_secret, payload)).

Python signing example

import hashlib, hmac, json, secrets, time
from urllib.parse import urlencode

method = "POST"
path = "/tradeuser/orders/limit"
query = {}
body = json.dumps({
    "pair": "BTC-USDT",
    "type": "LIMIT",
    "operation": "BUY",
    "quantity": "0.00100000",
    "price": "68000.00000000"
}, separators=(",", ":"))
timestamp = str(int(time.time()))
nonce = secrets.token_hex(16)
sorted_query = urlencode(sorted(query.items()), safe="~")
payload = "\n".join([method, path, timestamp, nonce, sorted_query, body])
signature = hmac.new(API_SECRET.encode(), payload.encode(), hashlib.sha256).hexdigest()

API key required

Limit orders

Use decimal strings

Price and quantity must be JSON strings. Numeric JSON values are rejected so clients cannot silently round financial values.

POST/tradeuser/orders/limit

Places a good-till-cancelled limit order and locks the required balance atomically.

{"pair":"BTC-USDT","type":"LIMIT","operation":"BUY","quantity":"0.00100000","price":"68000.00000000","client_order_id":"00000000-0000-4000-8000-000000000001"}

client_order_id is required. Generate and persist a new UUID before the first request, then reuse that UUID for every retry of the same order.

GET/tradeuser/orders?pair=BTC-USDT&state=OPEN&skip=0&limit=50

Lists the key owner's orders. State may be OPEN, FILLED, or CANCELLED; maximum limit is 50.

DELETE/tradeuser/orders/{id}

Cancels an owned open order, releases its remaining balance hold, and returns 204 No Content.

Errors and retries

Errors use a stable machine-readable code:

{"error":{"code":"invalid_signature","message":"The request signature is invalid."}}

Respect 429 and its Retry-After header. Retry read requests after temporary 503 responses. For order placement, use a persistent client_order_id UUID before retrying an uncertain client connection.