HTTP header:
API-Sign = Message signature using HMAC-SHA512 of (URI path + SHA256(nonce + POST data)) and base64 decoded secret API key
POST data:
otp = two-factor password (if two-factor enabled, otherwise not required)
If you look through the github for the Kraken Python 2 example, you can see that the headers and POST data are implemented in code as:
"""API queries that require a valid key/secret pair.
Arguments:
method -- API method name (string, no default)
req -- additional API request parameters (default: {})
conn -- connection object to reuse (default: None)
"""
urlpath = '/' + self.apiversion + '/private/' + method
req['nonce'] = int(1000*time.time())
postdata = urllib.urlencode(req)
message = urlpath + hashlib.sha256(str(req['nonce']) +
postdata).digest()
signature = hmac.new(base64.b64decode(self.secret),
message, hashlib.sha512)
headers = {
'API-Key': self.key,
'API-Sign': base64.b64encode(signature.digest())
}
return self._query(urlpath, req, conn, headers)
Full api.py is here: https://github.com/veox/python2-krakenex/blob/master/krakenex/api.py