Time SeventeenDocs
Getting Started

Authentication Preparation

Plan safe credential and signing-key handling before you integrate with private endpoints.

Draft v0.1 — design contract, not yet a live service

This documentation set defines a proposed Time Seventeen protocol for review and implementation planning. https://api.t17.capital is the approved and reserved REST origin, but neither that origin nor any documented endpoint is claimed to be live. The WebSocket origin remains unspecified. Credentials, chain IDs, contract addresses, rate limits, and SLAs remain unapproved; IDs, prices, and timestamps shown throughout are illustrative, not real production data.

This page is safety preparation, not the normative contract. Read API Reference → Authentication for the full canonical request-signing and EIP-712 design before writing integration code.

What you will eventually need

  • A scoped API key (key ID + secret) for request authentication — see Authentication → API keys.
  • A wallet capable of producing EIP-712 typed-data signatures for account authorization and, separately, for every order.
  • A clear answer to whether your signer and your funding/settlement account are the same address — Time Seventeen never assumes they are.

Security checklist

  • Keep secrets in an approved secret manager or environment configuration — never in source control or client-side JavaScript.
  • Never expose an API secret or a wallet private key to a browser-delivered bundle.
  • Separate development and production credentials and environments.
  • Redact credentials, signatures, and sensitive request headers from logs.
  • Plan key rotation and revocation before your first production integration, not after an incident.
  • Treat every client_order_id/order nonce as security-relevant: reusing one can trigger IDEMPOTENCY_CONFLICT or REPLAY_* errors by design, not by bug.

What this page does not do

It does not issue a real key, does not show a working signature, and does not claim a live token-issuance endpoint exists yet. Every value shown anywhere in this documentation that looks like a credential (for example YOUR_APPROVED_KEY_ID, YOUR_APPROVED_TOKEN) is an explicit placeholder.

Continue

Quickstart

Configure the reserved REST origin and placeholder WebSocket host, perform a public read, and validate the envelope — without assuming a live endpoint.

Market Data Workflow

Trace Index -> version -> constituents -> market prices -> index observation/history, end to end.

On this page

What you will eventually needSecurity checklistWhat this page does not doContinue