KEY="your-key-id"
SECRET="your-secret"
METHOD="POST"
URLPATH="/predictions-service/api/trading/orders"
BODY='{"market_id":"pm_6ae1e3c09e1d4c7a2b5f80e3d6a9c412","side":"yes","quantity":10,"price":0.59,"time_in_force":"FOK","request_id":"3f1c2a9e-5b7d-4e0a-9c1d-8a6b2e4f7d10"}'

TS=$(( $(date +%s) * 1000 ))
SIG=$(printf '%s' "$TS$METHOD$URLPATH$BODY" | openssl dgst -sha256 -hmac "$SECRET" -binary | base64)

curl -X "$METHOD" "https://api.splashsports.com$URLPATH" \
  -H "Content-Type: application/json" \
  -H "SPLASH-ACCESS-KEY: $KEY" \
  -H "SPLASH-ACCESS-TIMESTAMP: $TS" \
  -H "SPLASH-ACCESS-SIGNATURE: $SIG" \
  --data-binary "$BODY"

import base64, hashlib, hmac, json, time
import requests

KEY = "your-key-id"
SECRET = "your-secret"
HOST = "https://api.splashsports.com"


def sign(secret, timestamp, method, path, body):
    message = (timestamp + method + path + body).encode("utf-8")
    digest = hmac.new(secret.encode("utf-8"), message, hashlib.sha256).digest()
    return base64.b64encode(digest).decode("ascii")


def request(method, path, payload=None):
    body = json.dumps(payload, separators=(",", ":")) if payload is not None else ""
    timestamp = str(int(time.time() * 1000))
    headers = {
        "Content-Type": "application/json",
        "SPLASH-ACCESS-KEY": KEY,
        "SPLASH-ACCESS-TIMESTAMP": timestamp,
        "SPLASH-ACCESS-SIGNATURE": sign(SECRET, timestamp, method, path, body),
    }
    return requests.request(method, HOST + path, headers=headers, data=body.encode("utf-8"))


response = request(
    "POST",
    "/predictions-service/api/trading/orders",
    {
        "market_id": "pm_6ae1e3c09e1d4c7a2b5f80e3d6a9c412",
        "side": "yes",
        "quantity": 10,
        "price": 0.59,
        "time_in_force": "FOK",
        "request_id": "3f1c2a9e-5b7d-4e0a-9c1d-8a6b2e4f7d10",
    },
)
print(response.status_code, response.json())

const options = {
  method: 'POST',
  headers: {
    'SPLASH-ACCESS-KEY': '<api-key>',
    'SPLASH-ACCESS-TIMESTAMP': '<api-key>',
    'SPLASH-ACCESS-SIGNATURE': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    market_id: 'pm_6ae1e3c09e1d4c7a2b5f80e3d6a9c412',
    side: 'yes',
    quantity: 10,
    price: 0.59,
    time_in_force: 'FOK',
    request_id: '3f1c2a9e-5b7d-4e0a-9c1d-8a6b2e4f7d10'
  })
};

fetch('https://api.splashsports.com/predictions-service/api/trading/orders', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import { createHmac } from "node:crypto";

const KEY = "your-key-id";
const SECRET = "your-secret";
const HOST = "https://api.splashsports.com";

function sign(secret: string, timestamp: string, method: string, path: string, body: string): string {
  return createHmac("sha256", secret).update(timestamp + method + path + body, "utf8").digest("base64");
}

const method = "POST";
const path = "/predictions-service/api/trading/orders";

// Serialize once, sign that exact string, and send that exact string.
const body = JSON.stringify({
  market_id: "pm_6ae1e3c09e1d4c7a2b5f80e3d6a9c412",
  side: "yes",
  quantity: 10,
  price: 0.59,
  time_in_force: "FOK",
  request_id: "3f1c2a9e-5b7d-4e0a-9c1d-8a6b2e4f7d10",
});
const timestamp = Date.now().toString();

const response = await fetch(HOST + path, {
  method,
  headers: {
    "Content-Type": "application/json",
    "SPLASH-ACCESS-KEY": KEY,
    "SPLASH-ACCESS-TIMESTAMP": timestamp,
    "SPLASH-ACCESS-SIGNATURE": sign(SECRET, timestamp, method, path, body),
  },
  body,
});
console.log(response.status, await response.json());

package main

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"strconv"
	"time"
)

const (
	key    = "your-key-id"
	secret = "your-secret"
	host   = "https://api.splashsports.com"
)

func sign(secret, timestamp, method, path string, body []byte) string {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp + method + path))
	mac.Write(body)
	return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

func main() {
	method := "POST"
	path := "/predictions-service/api/trading/orders"

	// Marshal once, sign those exact bytes, and send those exact bytes.
	body, err := json.Marshal(map[string]any{
		"market_id": "pm_6ae1e3c09e1d4c7a2b5f80e3d6a9c412",
		"side": "yes",
		"quantity": 10,
		"price": 0.59,
		"time_in_force": "FOK",
		"request_id": "3f1c2a9e-5b7d-4e0a-9c1d-8a6b2e4f7d10",
	})
	if err != nil {
		panic(err)
	}
	timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)

	req, err := http.NewRequest(method, host+path, bytes.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("SPLASH-ACCESS-KEY", key)
	req.Header.Set("SPLASH-ACCESS-TIMESTAMP", timestamp)
	req.Header.Set("SPLASH-ACCESS-SIGNATURE", sign(secret, timestamp, method, path, body))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	out, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(out))
}