Access control

OAuth

Create an OAuth client and issue an access token for an app.

OAuth lets an app sign in to your workspace and call the Enterprise API as that user. Create a client in Settings > API Keys, then send the user through Authorize OAuth and Create OAuth token.

Each client has a name, a client id, a client secret shown once, scopes such as mcp:read or *, at least one redirect URI, and an expiration. Expiration can be a date or Never.

Create an OAuth client

Open API keys

Go to Settings > API Keys. Click Create API key.

Set the client

Name: A name for the client, such as the MCP integration.
Type: OAuth.
Redirect URIs: The callback URL for your app. At least one. It must match the redirect_uri you send to Authorize OAuth.
Scopes: * for every permission, or a smaller set such as mcp:read, proxy:write, or data:read.
Expires: A date, or Never.

Copy the credentials

The client id and client secret are shown once. Copy both before you leave the screen.

OAuth credentials panel showing Client ID, Client Secret, and a warning to store them

Get an access token

Send the user’s browser to Authorize OAuth. Blnk shows the sign-in page, then redirects to your app with a code.

Blnk login page

Exchange that code with Create OAuth token. The access token lasts 1 hour.

Use Create OAuth token again to refresh. The refresh token lasts 30 days, and each refresh replaces it.

Use the access token

Send the access token in X-blnk-key on Cloud API requests.

curl -X POST "https://api.cloud.blnkfinance.com/proxy/ledgers?instance_id=YOUR_INSTANCE_ID" \
  -H "X-blnk-key: OAUTH_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Integration Ledger"
  }'

Revoke an OAuth client

Revoke a client to stop it immediately. A revoked client stays in the list and cannot authenticate.

Open the client

Click the client name in the API Keys table.

Revoke it

In the details panel, click Revoke key.

Confirm

Confirm the revocation. The status in the table changes to Revoked.