We've seen teams get stuck on the request signing phase: HMAC-SHA512 with double hashing scares even experienced developers. Kraken's algorithm is one of the strictest among public crypto exchanges. But in practice, integration on mobile platforms takes half a day if you know the nuances. With over 10 years of experience and 40+ completed exchange API integrations, our team ensures stable operation without lockouts.
Problems We Solve
HMAC-SHA512 is the core of the signature, but errors arise from incorrect private key decoding. The private key is a Base64 binary secret, not an ASCII string. On iOS, a typical mistake is passing Data(privateKey.utf8) instead of Data(base64Encoded: privateKey)!. On Android, forgetting to decode Base64 before using Mac.getInstance("HmacSHA512"). Result: signature formed, but server returns authentication error.
Non-standard asset names: The REST API uses XBT instead of BTC, XDG instead of DOGE. Pairs look like XBTZUSD. WebSocket v2 normalizes (BTC/USD), but REST and historical data do not. Without a mapping table, users won't recognize their assets. We implement an alias map from AssetPairs.
Rate limiting without hints: Kraken does not return headers with remaining limit. Exceeding it results in an IP block for several minutes. We implement adaptive intervals: balance every 10 seconds, orders every 30 seconds, all market data via WebSocket.
How Kraken Request Signing Works
- Generate a nonce — Unix timestamp in milliseconds.
- Compute SHA256 of nonce + postData (URL-encoded string).
- Create HMAC-SHA512 of urlPath + the resulting hash, using the Base64-decoded private key.
Result — API-Sign. If nonce is not first in postData, Kraken returns EAPI:Invalid nonce. An incorrect signature can cost time and money: one mistaken order can lead to $100 loss. Our approach eliminates such errors. We use CryptoKit on iOS (available since iOS 13) and javax.crypto.Mac on Android. More details in the Kraken API documentation.
Why Kraken Asset Names Differ from Standard
Historically, Kraken used ISO codes with prefixes: X for base, Z for quote currency. XBT = Bitcoin, XDG = Dogecoin. Inside pairs, prefixes double: XXBTZUSD. WebSocket v2 switched to readable format (BTC/USD), but REST remained old. We build a table from AssetPairs and display convenient names while using originals in requests.
WebSocket API v2: Updates
With the transition to v2, the message format changed: from {"event":"subscribe"} to {"method":"subscribe","params":{...}}. Authorization for private channels: get a token via REST /0/private/GetWebSocketToken, pass it in params.token when subscribing to executions (orders) or balances. The token lives 15 minutes — a refresh mechanism is required. Without it, the session silently dies, and the user stops seeing order updates.
| Parameter | WebSocket v1 | WebSocket v2 |
|---|---|---|
| URL | wss://ws.kraken.com | wss://ws.kraken.com/v2 |
| Subscribe | event: subscribe | method: subscribe, params: {...} |
| Asset names | XBT/USD | BTC/USD |
| Private channels | Token in parameters | Token in params.token |
Example signing code in Swift:
import CryptoKit func generateSignature(urlPath: String, body: Data, secret: String) -> String { let secretData = Data(base64Encoded: secret)! let nonce = "\(Date().timeIntervalSince1970 * 1000)" var postData = "nonce=\(nonce)" if let additionalData = String(data: body, encoding: .utf8) { postData += "&\(additionalData)" } let sha256 = SHA256.hash(data: postData.data(using: .utf8)!) let hmac = HMAC<SHA512>.authenticationCode(for: urlPath.data(using: .utf8)! + sha256.data, using: SymmetricKey(data: secretData)) return hmac.compactMap { String(format: "%02x", $0) }.joined() } | Data | REST (polling) | WebSocket (push) |
|---|---|---|
| Balance | /0/private/Balance | balances channel |
| Orders | /0/private/OpenOrders | executions channel |
| Market data | /0/public/Ticker | ticker channel |
What's Included
- Analysis of your app's current architecture and selection of the appropriate stack (iOS: URLSession + Combine, Android: OkHttp + Coroutines).
- Implementation of signature and error handling (including WebSocket reconnection).
- Setup of push notifications (APNs/FCM) for order confirmations.
- Testing with real trading data simulating rate limits.
- Documentation — endpoint descriptions, request examples, operation instructions.
- Warranty — 30 days of free support after launch.
Want to avoid these issues? Order Kraken integration from us and get a free analysis of your app. We'll evaluate your project in one business day. Contact us for a consultation.
Stack and Timeline
For native iOS: CryptoKit (HMAC-SHA512), URLSessionWebSocketTask, Combine Publisher. For Android: Mac with HmacSHA512, OkHttp WebSocket, Kotlin Coroutines + Flow. Spot integration (no margin) — 3-4 weeks. Futures API — separate, with different authentication. If you want to estimate the timeline for your project, contact us.
We'll evaluate your project in one business day. Get a consultation on Kraken integration for your app — free of charge.