asterdex/aster-api-auth-v1
skills/aster-api-auth-v1/SKILL.md
HMAC SHA256 signed requests for Aster Futures API v1. X-MBX-APIKEY, timestamp, recvWindow, signature. Use when calling TRADE, USER_DATA, or USER_STREAM (/fapi/v1/ or v2/v4).
$ install --global
skillsauthnpx skillsauth add asterdex/aster-skills-hub aster-api-auth-v1Install this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 20, 2026, 3:19 PM1.6s1 file scanned
SKILL.md
- name:
- aster-api-auth-v1
- description:
- HMAC SHA256 signed requests for Aster Futures API v1. X-MBX-APIKEY, timestamp, recvWindow, signature. Use when calling TRADE, USER_DATA, or USER_STREAM (/fapi/v1/ or v2/v4).
Aster API Authentication (v1)
Base: https://fapi.asterdex.com. API key + secret case sensitive. Signed: send timestamp, signature; optional recvWindow (default 5000 ms, keep ≤ 5000).
| Param | Description | |-------|--------------| | X-MBX-APIKEY | API key (header) | | timestamp | Current time, ms | | recvWindow | Request valid this long after timestamp | | signature | HMAC SHA256(totalParams, secretKey), hex |
Signature: (1) totalParams = query + body (no & between; GET = query only; POST/PUT/DELETE = query + body as sent). (2) HMAC SHA256(secretKey, totalParams) → hex. (3) Add signature to query or body (last param); header X-MBX-APIKEY. Signature not case sensitive.
Timing: Server accepts if timestamp < serverTime+1000 and serverTime - timestamp <= recvWindow. Use GET /fapi/v1/time if clock skew. Security: Env vars for key/secret; keys can be restricted (TRADE-only etc.).
Payload shapes: reference.md.
Related Skills
asterdex/aster-deposit-fund
tools
VerifiedTrustedCommunity
Deposit funds to Aster from a wallet; private key from env. Use when the user wants to deposit to Aster or fund an Aster account.
62SKILL.mdUpdated Apr 3, 2026
asterdex/aster-api-websocket-v3
development
VerifiedTrustedCommunity
WebSocket market + user data streams for Aster Futures API v3. Subscription model, stream names, listenKey. Use when implementing real-time market or user events (orders, balance, positions). listenKey = signed; see aster-api-auth-v3.
62SKILL.mdUpdated Apr 3, 2026
asterdex/aster-api-websocket-v1
development
VerifiedTrustedCommunity
WebSocket market + user data streams for Aster Futures API v1. Subscription model, stream names, listenKey (/fapi/v1/listenKey). Use when implementing real-time market or user events (orders, balance, positions). listenKey = signed; see aster-api-auth-v1.
62SKILL.mdUpdated Apr 3, 2026
asterdex/aster-api-trading-v3
development
VerifiedTrustedCommunity
Place, cancel, batch, and query orders for Aster Futures API v3 (/fapi/v3/). Use when placing/canceling orders or querying open/historical. Signed; see aster-api-auth-v3.
62SKILL.mdUpdated Apr 3, 2026