Builder wallet registration

curl --get 'https://api.qfex.io/builder/web3/message' \
  --data-urlencode 'address=0x0000000000000000000000000000000000000001' \
  --data-urlencode 'builder_code=aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'

www.qfex.com wants you to sign in with your Ethereum account:
0x0000000000000000000000000000000000000001

Authorize QFEX to create a trading-only API key for builder aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa on my main account.

URI: https://www.qfex.com
Version: 1
Chain ID: 1
Nonce: 27c41a80ab6a61cf914075b1caffe3d8
Issued At: 2026-10-01T12:00:00Z
Expiration Time: 2026-10-01T12:10:00Z

export async function signBuilderMessage({ provider, builderCode }) {
  const accounts = await provider.request({ method: "eth_requestAccounts" });
  const address = accounts?.[0];
  if (!address) throw new Error("The wallet did not return an address");

  const chainId = await provider.request({ method: "eth_chainId" });
  if (Number.parseInt(chainId, 16) !== 1) {
    await provider.request({
      method: "wallet_switchEthereumChain",
      params: [{ chainId: "0x1" }],
    });
  }

  const url = new URL("https://api.qfex.io/builder/web3/message");
  url.searchParams.set("address", address);
  url.searchParams.set("builder_code", builderCode);

  const response = await fetch(url, { cache: "no-store", credentials: "omit" });
  const result = await response.json();
  if (!response.ok) {
    throw new Error(result.detail ?? "Could not fetch the wallet message");
  }

  const message = result.message;
  const hexMessage = "0x" + Array.from(
    new TextEncoder().encode(message),
    (byte) => byte.toString(16).padStart(2, "0"),
  ).join("");

  const signature = await provider.request({
    method: "personal_sign",
    params: [hexMessage, address],
  });

  return { message, signature };
}

import crypto from "node:crypto";

export async function registerWalletUser({ message, signature }) {
  const publicKey = process.env.QFEX_BUILDER_PUBLIC_KEY;
  const secretKey = process.env.QFEX_BUILDER_SECRET_KEY;
  if (!publicKey || !secretKey) {
    throw new Error("Builder credentials are not configured");
  }

  const nonce = crypto.randomBytes(16).toString("hex");
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const hmacSignature = crypto.createHmac("sha256", secretKey)
    .update(`${nonce}:${timestamp}`)
    .digest("hex");

  const response = await fetch("https://api.qfex.io/builder/web3/api-key", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-qfex-public-key": publicKey,
      "x-qfex-nonce": nonce,
      "x-qfex-timestamp": timestamp,
      "x-qfex-hmac-signature": hmacSignature,
    },
    body: JSON.stringify({ message, signature }),
    cache: "no-store",
  });

  const result = await response.json();
  if (!response.ok) {
    throw new Error(result.detail ?? "Could not create the trading key");
  }
  return result;
}

{
  "user_id": "11111111-1111-4111-8111-111111111111",
  "account_id": "11111111-1111-4111-8111-111111111111",
  "public_key": "qfex_pub_EXAMPLE",
  "secret_key": "qfex_secret_EXAMPLE"
}