import hashlib
import hmac
import json
import time
import requests

BASE = "https://api.your-domain.com"
API_KEY = "pmk_live_xxx"
API_SECRET = "pmsec_live_xxx"
TENANT_ID = "tenant_xxx"

def sign(method, path, query=None, body=None):
    query = query or ""
    body_text = json.dumps(body or {}, separators=(",", ":"), ensure_ascii=False) if method != "GET" else ""
    body_hash = hashlib.sha256(body_text.encode("utf-8")).hexdigest()
    ts = str(int(time.time() * 1000))
    canonical = "\n".join([ts, method, path, query, body_hash])
    signature = hmac.new(API_SECRET.encode("utf-8"), canonical.encode("utf-8"), hashlib.sha256).hexdigest()
    headers = {
        "X-PM-API-KEY": API_KEY,
        "X-PM-TIMESTAMP": ts,
        "X-PM-SIGNATURE": signature,
        "X-PM-TENANT-ID": TENANT_ID,
        "Content-Type": "application/json",
    }
    return headers, body_text

headers, _ = sign("GET", "/v1/quotes", query="symbols=AAPL.US,BTCUSD.CRYPTO&depth=1")
quotes = requests.get(f"{BASE}/v1/quotes?symbols=AAPL.US,BTCUSD.CRYPTO&depth=1", headers=headers, timeout=10).json()

order = {
    "symbol": "AAPL.US",
    "side": "buy",
    "type": "limit",
    "quantity": "10",
    "price": "188.00",
    "time_in_force": "DAY",
}
headers, body_text = sign("POST", "/v1/orders", body=order)
headers["Idempotency-Key"] = "idem-order-2026-001"
result = requests.post(f"{BASE}/v1/orders", headers=headers, data=body_text, timeout=10).json()