Introduction

WebSocket API for market makers participating in the Bitvavo Request for Quote (RFQ) platform.

Once you authenticate the session, you can subscribe to RFQ requests and submit firm quotes on this connection.

important

The Request for Quote WebSocket API is available only over AWS PrivateLink. Before you connect, set up AWS PrivateLink.

important

To get maker access and test credentials, contact [email protected].

Lifecycle

An RFQ session goes through the following steps:

1. Connect — open a WebSocket connection to the endpoint.
2. Authenticate — send authenticate and receive confirmation.
3. Subscribe — send subscribe for the desired RFQ types.
4. Receive RFQ requests — the server sends rfqRequest events when a taker initiates or refreshes.
5. Quote — send firmQuote within the collection window.
6. Acknowledge — receive quoteAck (quote enters competition and you become a participant) or quoteNack (your quote is rejected).
7. Outcome — the best quote (by price and time priority) is proposed to the taker. The winning maker receives rfqTrade. All other participants receive rfqTermination with rfqStatus and makerResult, delayed until after the hedge window to prevent information leakage.

Authentication

important

The Request for Quote WebSocket API is available only over AWS PrivateLink. Before you connect, set up AWS PrivateLink.

Open a WebSocket connection to the host and port for your environment using one of the endpoints below.

Live environment

Both ports serve the same traffic and provide failover if one becomes unreachable. We recommend connecting to both, but it is not required.

RFQ live environment

wss://connection.bitvavo.com:8004/rfq/v1
wss://connection.bitvavo.com:9004/rfq/v1

Test environment

Both ports serve the same traffic and provide failover if one becomes unreachable. We recommend connecting to both, but it is not required.

RFQ test environment

wss://connection.bitvavo-uat.com:8004/rfq/v1
wss://connection.bitvavo-uat.com:9004/rfq/v1

Once your connection is open, you must authenticate the session before subscribing or quoting. All subsequent actions on the connection run under the authenticated maker.

To do this, you need to:

1. Create a signature.
2. Send an action to authenticate your connection.

Step 1: Create a signature

You first need to create an HMAC-SHA256 hex-encoded signature:

1. Prepare the parameter values:

• timestamp: 1739462400123
• method: GET
• path: /rfq/v1
• body: do not include a body.

2. Concatenate the values without a delimiter:
   Concatenated string

   1739462400123GET/rfq/v1

3. Prepare the API secret for your Bitvavo-Access-Key. For example:
   API secret

   bitvavo

4. Encode the concatenated string to HMAC-SHA256 using the API secret for your API key. You get:
   Signature

   118067f093bef0f7b99bbc2a967a000fa288226d24b5c8ebc10e9cfb4229a6fa

Step 2: Send an action to authenticate

Now that you have created a signature, to authenticate your connection to the Request for Quote WebSocket API:

1. Connect to wss://connection.bitvavo.com:8004/rfq/v1.
2. Create a JSON object with:
   • action: authenticate
   • key: YOUR_API_KEY
   • signature: the signature you created.
   • timestamp: the Unix timestamp in milliseconds of the time you make the request.
   • window (optional): the time in milliseconds in which your request is allowed to execute. The default value is 10000, and the maximum value is 60000.
   • requestId (optional): your identifier for the request. It is echoed in the response so you can correlate acknowledgements.
3. Send the message to the WebSocket API:

Authenticate message

{
  "action": "authenticate",
  "requestId": 9021001,
  "key": "YOUR_API_KEY",
  "signature": "118067f093bef0f7b99bbc2a967a000fa288226d24b5c8ebc10e9cfb4229a6fa",
  "timestamp": 1739462400123,
  "window": 10000
}

4. The server confirms the session is authenticated:

Authenticate response

{
  "event": "authenticate",
  "requestId": 9021001,
  "authenticated": true
}

Your connection is now authenticated, and you can submit firm quotes and subscribe to the RFQ requests channel.

Python example

The following Python code sample shows how to sign the authenticate message.

Authenticate message

import hashlib
import hmac
import json
import websocket
import time

class BitvavoRfqWebSocketClient:
    """
    A class to interact with the Bitvavo Request for Quote WebSocket API.
    """

    def __init__(self, api_key: str, api_secret: str, access_window: int = 10000):
        self.api_key = api_key
        self.api_secret = api_secret
        self.access_window = access_window
        self.endpoint = 'wss://connection.bitvavo-uat.com:8004/rfq/v1'
        self.request_id = 0
        self.ws = None

    def authenticate(self):
        """
        Send an instruction to Bitvavo to authenticate your RFQ maker connection.
        """
        timestamp = int(time.time() * 1000)
        body = {
          'key': self.api_key,
          'signature': self.create_signature(timestamp),
          'timestamp': timestamp,
          'window': self.access_window,
        }
        self.call_action(action='authenticate', body=body)

    def create_signature(self, timestamp: int):
        """
        Create a hashed code to authenticate your connection to the Bitvavo RFQ API.
        """
        string = str(timestamp) + 'GET' + '/rfq/v1'
        signature = hmac.new(self.api_secret.encode('utf-8'), string.encode('utf-8'), hashlib.sha256).hexdigest()
        return signature

    def call_action(self, action: str, body: dict):
        """
        Send an instruction to Bitvavo to perform an action.
        """
        request_id = self.request_id
        self.request_id += 1

        body['action'] = action
        body['requestId'] = request_id

        self.send_message(body)

    def send_message(self, message: dict):
        """
        Send a message to the Bitvavo Request for Quote WebSocket API.
        """
        if self.ws is None:
            self.ws = websocket.create_connection(self.endpoint)
        self.ws.send(json.dumps(message))

Permissions

To use the Request for Quote WebSocket API, your API key must have RFQ maker access enabled. Contact [email protected] to onboard as an RFQ maker.