Huobi and HTX: Fixing a Signature Timestamp That Only Failed Part of the Day

Some bugs fail every time. Some fail on a schedule. The Huobi and HTX signing defect fixed in 2026.9 was the second kind, and that made it far harder to pin down: on a host running outside UTC, private requests failed for part of every day and worked for the rest of it, which looks exactly like an intermittent authentication problem right up until someone notices the pattern lines up with the clock.

A timestamp built from two different clocks

Huobi and HTX both require the signed request to carry a timestamp in UTC, formatted as yyyy-MM-ddTHH:mm:ss. The signing routine in TsgcWS_API_Huobi_Base, shared by both TsgcWSAPI_Huobi and TsgcWSAPI_HTX, was building that timestamp from two different sources: the date portion came from the local system clock, the time portion came from UTC. For most of the day on most machines, local date and UTC date are the same value, so nothing looked wrong. Near midnight UTC, on any host whose local timezone offset put it on the other side of that boundary, the date and the time stopped agreeing with each other, the signature Huobi computed on its own end did not match, and the request was rejected.

The fix takes both the date and the time from the same UTC value:

uses
  sgcBase_Helpers;

var
  vUTC: TDateTime;
  vTimeStamp: string;
begin
  vUTC := sgcGetDateTimeAsUTC;
  vTimeStamp := FormatDateTime('yyyy-mm-dd', vUTC) + 'T' +
    FormatDateTime('hh:nn:ss', vUTC);
end;

There is nothing to configure. TsgcWSAPI_Huobi and TsgcWSAPI_HTX both call this same signing routine, so both are fixed together:

uses
  sgcWebSocket, sgcWebSocket_APIs;

var
  oHuobi: TsgcWSAPI_Huobi;
begin
  oHuobi := TsgcWSAPI_Huobi.Create(nil);
  oHuobi.Client := oClient;
  oHuobi.Huobi.ApiKey := 'your_api_key';
  oHuobi.Huobi.ApiSecret := 'your_api_secret';
  oClient.Active := True;
  // Authentication now signs with a timestamp taken entirely from UTC.
  oHuobi.SubscribeOrderUpdates('btcusdt');
end;

If your logs show private Huobi or HTX requests failing in a way that seemed to come and go without a clear trigger, this is very likely why, particularly if your servers do not run in UTC.

Private subscriptions lost on reconnect

Huobi was also one of several exchange clients affected by a separate reconnect defect fixed in the same pass: after the WatchDog reconnected, private subscriptions, orders, balances, fills, were not replayed. The reconnect itself succeeded and logged as such, so there was nothing to indicate that the private feeds you had been receiving before the disconnect were now silently gone. That replay is now part of the same resubscribe path that already restores public market data subscriptions after a reconnect.

Upgrading

Both fixes are drop-in. There is no property to set and no code to change, the signature is simply correct now, and the reconnect replay now includes your private subscriptions.

Questions, feedback or migration help? Get in touch — you will get a reply from the people who wrote the code.