This endpoint generates an access token (JWT) that must be included as a Bearer token in all subsequent API requests.

Authentication Flow

1. Compute HMAC-SHA256 signature  →  using API key + secret + payload
2. POST to this endpoint          →  with X-Api-Key + X-Api-Signature headers
3. Receive accessToken            →  JWT with expiry
4. Use token in all API calls     →  Authorization: Bearer {accessToken}

Headers

Header	Required	Description
`X-Api-Key`	✅	Your Neutron API key
`X-Api-Signature`	✅	HMAC-SHA256 signature (hex)
`Content-Type`	✅	`application/json`

Signature Computation

The signature is computed as:

stringToSign = "{apiKey}&payload={requestBody}"
signature    = HMAC-SHA256(apiSecret, stringToSign) → hex

The request body can be any valid JSON (e.g., {"test":"auth"}). The same JSON is sent as the POST body.

📘
For complete code samples in Node.js, Python, Go, C#, and Java, see Signature Generation.

Example

curl -X POST https://api.neutron.me/api/v2/authentication/token-signature \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "X-Api-Signature: YOUR_COMPUTED_SIGNATURE" \
  -d '{"test":"auth"}'

Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiredAt": 1770428400000,
  "accountId": "ne01-abc123def456"
}

Using the Token

Pass the token as a Bearer token in the Authorization header for all API calls:

curl https://api.neutron.me/api/v2/account/YOUR_ACCOUNT_ID \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Important Notes

The token has a limited validity period — check expiredAt in the response
Using an expired token returns 401 Unauthorized — re-authenticate to get a new one
The signature is one-time — compute a fresh signature for each authentication request
There is no refresh token mechanism — simply call this endpoint again when needed