Skip to main content
This guide covers the auth contract changes introduced in Blnk v0.14.3. Review this guide if your app:
  • Manages transaction hooks with a scoped API key
  • Uses a scoped API key to create, list, or revoke keys for another owner
  • Grants scopes that the calling key does not already have

​
Breaking changes summary

The master key still has full access to manage hooks and API keys for any owner.

​
Hook management requires the master key

From 0.14.3, only the master key can create, update, view, list, or delete hooks. Scoped API keys return 403 Forbidden for hook endpoints, even if they include hooks scopes. What to do:
  1. Use the master key for all hook management requests.
  2. Keep scoped keys for ledger operations that do not manage hooks.
  3. See Transaction hooks.

​
Owner-scoped API key management

When you manage API keys with a scoped key:
  1. Blnk uses the caller’s stored owner_id. A different owner in the request body is ignored.
  2. The key can only create, list, and revoke keys for that same owner.
  3. The key can only grant scopes it already has.
What to do:
  1. Create one admin scoped key per owner if teams need delegated key management.
  2. Use the master key when you must manage keys across owners.
  3. See API key owner context.

​
Migration checklist

  • Switch hook create, update, get, list, and delete calls to the master key
  • Confirm scoped key admin flows only target the caller’s own owner_id
  • Confirm create-key requests do not grant scopes the caller lacks
  • Re-test hook registration and API key create/list/revoke after upgrade

​
Need help?

We are very happy to help you make the most of Blnk, regardless of whether it is your first time or you are switching from another tool. To ask questions or discuss issues, please contact us or join our Discord community.