Struct Credential 

pub struct Credential { /* private fields */ }

Deribit API credentials for signing requests.

Uses HMAC SHA256 for request signing as per Deribit API specifications. Secrets are automatically zeroized on drop for security.

Implementations

impl Credential

pub fn new(api_key: String, api_secret: String) -> Self

Creates a new Credential instance.

pub fn from_env(environment: DeribitEnvironment) -> Option<Self>

Load credentials from environment variables.

For mainnet: Looks for DERIBIT_API_KEY and DERIBIT_API_SECRET. For testnet: Looks for DERIBIT_TESTNET_API_KEY and DERIBIT_TESTNET_API_SECRET.

Returns None if either key or secret is not set.

pub fn resolve( api_key: Option<String>, api_secret: Option<String>, environment: DeribitEnvironment, ) -> Result<Option<Self>, CredentialError>

Resolves credentials from provided values or environment.

If both api_key and api_secret are provided, uses those. Otherwise falls back to loading from environment variables.

Errors

Returns an error if only one of api_key or api_secret is provided.

pub fn resolve_with_env_fallback( api_key: Option<String>, api_secret: Option<String>, environment: DeribitEnvironment, env_fallback: bool, ) -> Result<Option<Self>, CredentialError>

Resolves credentials with optional environment fallback.

If both api_key and api_secret are provided, uses those. If env_fallback is true and neither credential is provided, loads from environment. If env_fallback is false and neither credential is provided, returns Ok(None).

Errors

Returns an error if only one of api_key or api_secret is provided (partial credentials). This prevents silent fallback to environment variables when user intent is unclear.

pub fn api_key(&self) -> &str

Returns the API key associated with this credential.

pub fn api_key_masked(&self) -> String

Returns a masked version of the API key for logging purposes.

Shows first 4 and last 4 characters with ellipsis in between. For keys shorter than 8 characters, shows asterisks only.

pub fn sign_ws_auth(&self, timestamp: u64, nonce: &str, data: &str) -> String

Signs a WebSocket authentication request according to Deribit specification.

Deribit WebSocket Signature Formula

StringToSign = Timestamp + "\n" + Nonce + "\n" + Data
Signature = HEX_STRING(HMAC-SHA256(ClientSecret, StringToSign))

Returns

Hex-encoded HMAC-SHA256 signature

pub fn sign_auth_headers( &self, method: &str, uri: &str, body: &[u8], ) -> Result<HashMap<String, String>, DeribitHttpError>

Signs a request and generates authentication headers.

Deribit Authentication Scheme

RequestData = UPPERCASE(HTTP_METHOD) + "\n" + URI + "\n" + RequestBody + "\n"
StringToSign = Timestamp + "\n" + Nonce + "\n" + RequestData
Signature = HEX_STRING(HMAC-SHA256(ClientSecret, StringToSign))
Authorization: deri-hmac-sha256 id={ClientId},ts={Timestamp},nonce={Nonce},sig={Signature}

Errors

Returns an error if credentials are not configured.

Trait Implementations

impl Clone for Credential

fn clone(&self) -> Credential

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for Credential

fn drop(&mut self)

Executes the destructor for this type.