Backpack Exchange: how to sign REST, stream fills, and use RFQ logoBackpack Exchange: how to sign REST, stream fills, and use RFQ
Create a key in account settings. Sign instruction + sorted params + timestamp + window. 70 paths. June developer guide stays.
devrels.xyz/a/314Backpack Exchange publishes a REST and WebSocket API for programmatic trade. The live source is Redoc OpenAPI 3.0, spec version 1.0, 70 paths. Create a key in account settings. REST is https://api.backpack.exchange/. Streams are wss://ws.backpack.exchange/.
Auth is an ED25519 keypair you control. The server verifies a signature over an instruction string, not an opaque API secret. That is the same curve Solana uses for account keys. The longer June walkthrough stays: Backpack Exchange API developer guide. A Rust client lives at backpack-exchange/bpx-api-client.
What you sign
Signed requests are required for any call that mutates state. Some reads can be signed or done with a session. Four headers:
| Header | Value |
|---|---|
X-Timestamp | Unix time in milliseconds when you send the request |
X-Window | Validity window in ms. Default 5000. Maximum 60000 |
X-API-Key | Base64 ED25519 verifying key |
X-Signature | Base64 signature of the instruction string |
Build the string in this order. Sort body or query keys alphabetically into k=v pairs. Prefix instruction=<type>. Append ×tamp=<ms>&window=<window>. If you omit the X-Window header, still sign the default 5000. Sign that UTF-8 string with the matching private key. Endpoints with no body and no query sign only timestamp and window, still with the instruction prefix documented on that route.
instruction=orderCancel&orderId=28&symbol=BTC_USDT×tamp=1614550000000&window=5000Batch POST /orders repeats a full instruction=orderExecute&... block per order, concatenated with &, then one timestamp and window at the end.
instruction=orderExecute&orderType=Limit&price=141&quantity=12&side=Bid&symbol=SOL_USDC_PERP&instruction=orderExecute&orderType=Limit&price=140&quantity=11&side=Bid&symbol=SOL_USDC_PERP×tamp=1750793021519&window=5000Instruction types
Every signed route has a documented instruction name. The spec lists them next to the request. Examples from the live intro:orderExecute, orderCancel, orderCancelAll, accountQuery, balanceQuery, withdraw, rfqSubmit, quoteSubmit, quoteAccept, strategyCreate. Using the wrong instruction invalidates the signature even if the JSON body is correct.
Public market data
Unauthenticated reads cover connectivity and the book. GET /api/v1/ping, /time, /status, /markets, /market, /ticker, /tickers, /depth, /klines, /trades, /trades/history, /markPrices, /fundingRates, /openInterest, /assets, /securities, plus market holidays and sessions. Start here to confirm the host before you sign anything.
Private REST
Account, capital, collateral, wallets, positions, and orders live under /api/v1/.... Deposits, withdrawals, and fill history live under /wapi/v1/.... Borrow/lend has its own markets, positions, APY, and liquidation price. Dust convert is /api/v1/account/convertDust.
Limits are explicit: /api/v1/account/limits/order, /borrow, /withdrawal. Query those before you size an order or a withdraw, rather than discovering the cap from a 4xx.
RFQ
Request-for-quote is a first-class path group: POST /api/v1/rfq (rfqSubmit), /rfq/quote, /rfq/accept, /rfq/refresh, /rfq/cancel, and list via /rfqs. History is under /wapi/v1/history/rfq and /history/rfq/fill.
Lifecycle on the account.rfqUpdate stream: requester submits, engine emits rfqAccepted then broadcasts rfqActive to makers. Quotes land until the submission window. Best quote is rfqCandidate. Accept fills immediately, or, for the exchange broker on stock markets, locks funds as rfqAcceptedBinding until the broker settles.
Prediction, vaults, strategies
Same 70-path spec, newer groups. Prediction: /api/v1/prediction and /prediction/tags. Vaults: list and history, plus mint, redeem, pending redeems, and NAV. Strategies: create, cancel, cancel-all, query, and history under /wapi/v1/history/strategies. Treat each as its own instruction family. Do not reuse orderExecute on these routes.
WebSocket
Connect to wss://ws.backpack.exchange/. Public book and trade streams sit next to account streams. RFQ state is account.rfqUpdate. Keep the same keypair you used on REST if the stream requires a signed subscribe. The Redoc page is the stream catalog. This article does not invent channel names beyond what the intro documents.
A working order of operations
- Generate an ED25519 keypair. Register the public key in settings.
- Hit
GET /api/v1/pingand/marketswith no auth. - Sign
accountQueryorbalanceQueryand confirm the window math. - Place one limit on a market you already understand, then cancel it with
orderCancel. - Only then subscribe to fills and, if you need it, RFQ.
Official socials
From Backpack's own Start Here page. Use these, not lookalikes.
- X: @Backpack
- Support X: @BackpackHelp
- Discord: discord.gg/backpack
- LinkedIn: backpackexchange
- Telegram CN: BackpackExchangeSupportChinese
- Telegram ES: backpackespanol
- Learn: learn.backpack.exchange
Resources
Keep reading
Backpack Exchange processes orders through a single linear command stream into one matching engine. The API uses ED25519 keypair auth — no API-key secrets, just public/private keypairs you control. REST at api.backpack.exchange, WebSocket at wss://ws.backpack.exchange. Official Rust SDK; community Python SDK on PyPI.
Prepare returns an unsigned payment transaction. Sign it locally. Submit. Poll the payment signature. Never pay twice.
Parse signatures or address history into decoded instructions, transfers, and summaries. Same IDL catalog as Parsed Streams. Enhanced Transactions stays in maintenance mode.
Get new articles in your inbox
Technical deep-dives on Solana tooling, infrastructure, and ecosystem. No noise.
