Authentication

Access

The source data endpoints, GET /indices/{name}/history/sources and GET /indices/{name}/history/export, are available to members of institutions approved for Index Explorer source data. The other endpoints are public and need no key.

Create a key on Index Explorer. The secret is shown once, so store it securely.
Approval is checked on every request. If your institution’s approval ends, its keys stop working within about a minute.
Each account can make 300 requests per minute to these endpoints by default. A 429 response includes a Retry-After header.

Signing Requests

Send three headers with every request:

Header	Value
`FORUM-ACCESS-KEY`	Your key ID, starting with `fk_`
`FORUM-ACCESS-TIMESTAMP`	The current Unix time in seconds
`FORUM-ACCESS-SIGN`	Base64-encoded HMAC-SHA256 of the prehash, keyed with your secret

The prehash is the timestamp, the uppercase HTTP method, the request path and the body, joined with no separator:

1792699200GET/v1/indices/FORTNITE-IDX/history/sources

The path includes /v1 and excludes the query string.
The body is empty for GET requests.
The timestamp must be within 30 seconds of our server’s time. GET https://api.forum.market/v1/time returns it.
Use the secret string as the HMAC key as is. Do not base64-decode it.

Example

import base64
import hashlib
import hmac
import time

import requests

KEY_ID = "fk_..."
SECRET = "..."
BASE_URL = "https://api.forum.market"


def get(path, params=None):
    timestamp = str(int(time.time()))
    prehash = timestamp + "GET" + path
    signature = hmac.new(SECRET.encode(), prehash.encode(), hashlib.sha256).digest()
    headers = {
        "FORUM-ACCESS-KEY": KEY_ID,
        "FORUM-ACCESS-TIMESTAMP": timestamp,
        "FORUM-ACCESS-SIGN": base64.b64encode(signature).decode(),
    }
    response = requests.get(BASE_URL + path, params=params, headers=headers)
    response.raise_for_status()
    return response.json()


sources = get(
    "/v1/indices/FORTNITE-IDX/history/sources",
    {"start": "2026-10-01T00:00:00Z", "interval": "1d"},
)

history, params = [], {"afterId": 0}
while True:
    page = get("/v1/indices/FORTNITE-IDX/history/export", params)
    history += page["history"]
    if page["nextAfterId"] is None:
        break
    params = {"afterId": page["nextAfterId"], "throughId": page["throughId"]}

Errors

Status	Meaning
`401`	Headers missing, key unknown or revoked, timestamp out of window, or signature mismatch
`403`	The key’s owner is not in an approved institution
`429`	Account rate limit reached

Indices

Source Data

Access

Signing Requests

Example

Errors

​Access

​Signing Requests

​Example

​Errors

Access

Signing Requests

Example

Errors