Guide: Invalid or Expired Token Error in the Binance Pay API

✨ Quick Answer

The Invalid Signature or Token Expired error in the Binance Pay API occurs when you attempt to process a payment in USDT or another cryptocurrency and the Binance servers reject the request. The primary cause is a timestamp desynchronization between your local server and Binance's official clock, or incorrect concatenation of API keys when generating the HMAC-SHA512 cryptographic signature.

Quick Diagnostics

Cause

Binance API Key/Secret expired, copied incorrectly, or IP not whitelisted

Solution

Generate new Binance API Key and whitelist server static IP

Cause

Local system clock out of sync with Binance server time

Solution

Sync server clock with NTP: sudo ntpdate pool.ntp.org

The Invalid Signature or Token Expired error in the Binance Pay API occurs when you attempt to process a payment in USDT or another cryptocurrency and the Binance servers reject the request. The primary cause is a timestamp desynchronization between your local server and Binance's official clock, or incorrect concatenation of API keys when generating the HMAC-SHA512 cryptographic signature.

Step-by-Step Solution

1. 1

   Step 1: Synchronize the server clock (NTP)

   Binance rejects any request whose timestamp varies by more than a few seconds from their server's time. On your Linux server, force time synchronization by running:

   BASH Copy

   sudo timedatectl set-ntp true
   sudo systemctl restart systemd-timesyncd
   

   Verify that the time is perfectly aligned using the timedatectl command.

2. 2

   Step 2: Order variables for the signature (Payload)

   The cryptographic signature requires you to join the timestamp, a random string (nonce), and the request body (JSON body string) in a strict format. Ensure your code concatenates the elements exactly in this order before hashing it:

   PLAINTEXT Copy

   TIMESTAMP + "\n" + NONCE + "\n" + BODY_JSON_STRING + "\n"
   

   A common mistake is that the JSON in your code orders the keys differently than how they are sent in the HTTP body, immediately breaking the signature.