HMAC request signing, and the clock skew that looks like an auth failure
Post the average bitcoin price across exchanges, in Spanish. The English-language price bots were everywhere and there were very few for Spanish-speaking audiences.
Thirty lines, and one of them is worth the note. BitcoinAverage authenticates with a signature rather than a bearer token, and the construction is a compact example of how request signing works.
The payload is timestamp.public_key. That string is HMAC-SHA256’d with the
secret, and the header sent is payload.hexdigest. Two details do real work.
The timestamp is inside the signed payload, so a captured request cannot be
replayed outside the server’s tolerance window, because the signature covers the
time it was made. The public key is inside it too, binding the signature to a
specific key rather than leaving the server to guess which secret to verify
against.
The failure mode is worth knowing in advance: if the client clock drifts past tolerance, every request fails authentication, and the error says the signature is invalid because from the server’s side it is. Nothing points at the clock, and people lose hours to this.
The client is open-uri with a custom header, which gives no retry, no
keepalive and no timeout control. Fine for an hourly script.
Both keys are committed in the source.