Action Signing

import { DeriveClient } from '@derivexyz/derive-ts';

const client = new DeriveClient({
  network: 'mainnet',
  wallet: process.env.PRIVATE_KEY!,
});
await client.connect();
await client.login();

// Signed by the wallet key held in the client (owner == signer). The nonce,
// signature, and signature_expiry_sec are generated and signed for you.
const { order } = await client.orders.place({
  subaccountId: 9,
  instrumentName: 'ETH-20260626-3000-C',
  direction: 'buy',
  amount: '1',
  limitPrice: '310',
  maxFee: '0.01',
});
console.log(order.order_id);

import asyncio
from decimal import Decimal

from derive_py import WebSocketClient
from derive_py.data_types import Direction


async def main():
    client = WebSocketClient.from_env()
    await client.connect()

    # Signed by the key held in the client. The nonce, signature, and
    # signature_expiry_sec are generated and signed for you.
    response = await client.orders.create(
        instrument_name="ETH-20260626-3000-C",
        direction=Direction.buy,
        amount=Decimal("1"),
        limit_price=Decimal("310"),
        max_fee=Decimal("0.01"),
    )
    print(response.order.order_id)

    await client.disconnect()


asyncio.run(main())

use bigdecimal::BigDecimal;
use derive_rs::{
    Environment, WsClient,
    actions::OrderArgs,
    models::{Direction, OrderType, TimeInForce},
};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = WsClient::new(
        Environment::Mainnet,
        Some(std::env::var("DERIVE_PRIVATE_KEY")?),
        Some(std::env::var("DERIVE_WALLET")?),
        Some(9),
    )
    .await?;
    client.login().await?;

    // Signed by the wallet key held in the client (owner == signer). The nonce,
    // signature, and signature_expiry_sec are generated and signed for you.
    let order = OrderArgs::builder()
        .instrument_name("ETH-20260626-3000-C".to_string())
        .direction(Direction::Buy)
        .order_type(OrderType::Limit)
        .time_in_force(TimeInForce::Gtc)
        .amount(BigDecimal::from(1))
        .limit_price(BigDecimal::from(310))
        .build();

    let response = client.orders().place(order).await?;
    println!("{}", response.order.order_id);
    Ok(())
}

# No SDK: every step done by hand. pip install eth-abi eth-account requests
import os, random, time
from decimal import Decimal

import requests
from eth_abi import encode as abi_encode
from eth_account import Account
from eth_account.messages import encode_defunct
from eth_utils import keccak, to_checksum_address

BASE_URL = "https://api.derive.xyz/v3"
CHAIN_ID = 1  # Sepolia (11155111) on testnet
MATCHING = "0xeB8d770ec18DB98Db922E9D83260A585b9F0DeAD"
TRADE_MODULE = "0xB8D20c2B7a1Ad2EE33Bc50eF10876eD3035b5e7b"

# keccak("Action(uint256 subaccountId,uint256 nonce,address module,bytes data,
#         uint256 expiry,address owner,address signer)") — same on every deployment.
ACTION_TYPEHASH = bytes.fromhex("4d7a9f27c403ff9c0f19bce61d76d82f9aa29f8d6d4b0c5474607d9770d1af17")

session_key = Account.from_key(os.environ["PRIVATE_KEY"])  # signer
owner = to_checksum_address(os.environ["OWNER"])
subaccount_id = 9


def e18(value: str) -> int:
    """The exchange rejects, not truncates, sub-1e12 precision."""
    scaled = int(Decimal(value) * 10**18)
    if scaled % 10**6:
        raise ValueError("more than 12 decimal places can never verify")
    return scaled


# 1. The action signs the asset, not the instrument name.
instrument = requests.post(
    f"{BASE_URL}/public/get_instrument",
    json={"instrument_name": "ETH-20260626-3000-C"},
).json()["result"]

# 2. Action data: seven static words, decimals e18-scaled.
encoded_data = abi_encode(
    ["address", "uint256", "int256", "int256", "uint256", "uint256", "bool"],
    [
        to_checksum_address(instrument["base_asset_address"]),
        int(instrument["base_asset_sub_id"]),
        e18("310"),   # limit_price
        e18("1"),     # amount
        e18("0.01"),  # max_fee
        subaccount_id,  # recipient_id
        True,           # is_bid
    ],
)

# 3. EIP-712 struct hash of the Action envelope. Step 5 resends these two
#    values verbatim, so they have to be bound before signing.
nonce = int(time.time() * 1000) * 10**6 + random.randrange(10**6)  # nonce
expiry_sec = int(time.time()) + 300  # expiry_sec

action_hash = keccak(
    abi_encode(
        ["bytes32", "uint256", "uint256", "address", "bytes32", "uint256", "address", "address"],
        [
            ACTION_TYPEHASH,
            subaccount_id,
            nonce,
            to_checksum_address(TRADE_MODULE),
            keccak(encoded_data),
            expiry_sec,
            owner,
            session_key.address,  # signer; pass owner here if the wallet signs directly
        ],
    )
)

# 4. Domain separator, then the digest to sign.
domain_separator = keccak(
    abi_encode(
        ["bytes32", "bytes32", "bytes32", "uint256", "address"],
        [
            keccak(b"EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
            keccak(b"Matching"),
            keccak(b"1.0"),
            CHAIN_ID,
            to_checksum_address(MATCHING),
        ],
    )
)
digest = keccak(b"\x19\x01" + domain_separator + action_hash)
signature = "0x" + Account.unsafe_sign_hash(digest, session_key.key).signature.hex()

# 5. Submit. Wire decimals are formatted from the signed e18 words so the
#    exchange re-derives the exact bytes the signature commits to.
login_ts = str(int(time.time() * 1000))
login_sig = Account.sign_message(encode_defunct(text=login_ts), session_key.key).signature
response = requests.post(
    f"{BASE_URL}/private/order",
    headers={
        "X-DeriveWallet": owner,
        "X-DeriveTimestamp": login_ts,
        "X-DeriveSignature": "0x" + login_sig.hex(),
    },
    json={
        "subaccount_id": subaccount_id,
        "instrument_name": "ETH-20260626-3000-C",
        "direction": "buy",
        "limit_price": "310",
        "amount": "1",
        "max_fee": "0.01",
        "nonce": str(nonce),  # decimal string on the wire
        "signer": session_key.address,
        "signature": signature,
        "signature_expiry_sec": expiry_sec,
        "order_type": "limit",
        "time_in_force": "gtc",
    },
).json()
print(response["result"]["order"]["order_id"])