Using OAuth

OAuth clients provide secure authentication for MCP and third-party integrations to access Blnk. To manage your OAuth clients, go to Settings > API Keys. Each OAuth client has:

Name: A user-friendly identifier to help you organize and identify clients
Client ID: A public identifier for your OAuth client
Client Secret: A secret credential used for authentication (shown only once at creation)
Scopes: Permissions that define what the client can access (e.g., * for all permissions, or specific scopes like mcp:read, proxy:write, or data:read)
Expiration: Optional expiration date, or Never for clients that don’t expire

To use OAuth clients, you’ll need to:

Create an OAuth client
Get an access token
Use the access token with Cloud APIs; refresh once it expires or reauthenticate OAuth

Create an OAuth client

Navigate to API Keys

Go to Settings > API Keys in your Blnk Cloud dashboard. Click Create API Key in the top-right corner of the API Keys page.

API keys page with the Create API key button highlighted

Configure your OAuth client

Fill in the required information:

Name: Enter a descriptive name for your OAuth client (e.g., “Production OAuth Client”, “MCP Integration”)
Type: Select OAuth (instead of API Key)
Scopes: Select the permissions for this client:
- * for all permissions
- Specific scopes like mcp:read, proxy:write, or data:read for limited access
Expires: Choose when the client should expire:
- Select a specific date
- Choose Never for clients that don’t expire

Save your OAuth credentials

After creating the client, your Client ID and Client Secret will be displayed only once. Copy both immediately and store them securely.

OAuth credentials panel showing Client ID, Client Secret, and warning to store credentials securely

You cannot retrieve the Client Secret after creation. If you lose the secret, you must revoke it and create a new OAuth client.

Get an access token

For third-party integrations, you’ll need an access token to interact with the user’s Cloud workspace via the Cloud Proxy, Filters API, and Create new query.

Get callback code

Redirect the user’s browser to the Blnk authorization URL to log in:

Authorization URL

https://api.cloud.blnkfinance.com/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=https://your-app.com/oauth/callback

Replace:

YOUR_CLIENT_ID: Your OAuth client ID.
redirect_uri: Your app’s callback URL (for example, https://your-app.com/oauth/callback). This must match exactly when you exchange the code.

After the user signs in, Blnk redirects back to your app with an authorization code:

Redirect back

https://your-app.com/oauth/callback?code=THE_AUTH_CODE

Exchange the code for an access token

Call the token endpoint with the authorization code and your OAuth client credentials. This access token is valid for 1 hour.

cURL

curl -X POST "https://api.cloud.blnkfinance.com/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d "grant_type=authorization_code" \
  -d "code=THE_CODE_FROM_REDIRECT" \
  -d "redirect_uri=https://your-app.com/oauth/callback"

200 OK

{
  "access_token": "blnk_at_...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "blnk_rt_...",
  "scope": "data:read data:write proxy:write"
}

Refresh an expired access token

When the access token expires, use its refresh token to get a new one. The refresh token is valid for 30 days. After 30 days, you’ll need to get a new refresh token by reauthenticating OAuth.

cURL

curl -X POST "https://api.cloud.blnkfinance.com/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=blnk_rt_YOUR_REFRESH_TOKEN_HERE"

Use the access token with Cloud APIs

Include your access token in the Authorization header for Cloud API requests:

Example request

curl -X POST "https://api.cloud.blnkfinance.com/transactions/filter?instance_id=YOUR_INSTANCE_ID" \
  -H "Authorization: Bearer OAUTH_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": [
      { "field": "status", "operator": "eq", "value": "APPLIED" }
    ]
  }'

Revoke an OAuth client

If you need to disable an OAuth client without deleting it permanently, you can revoke it. Revoked clients cannot be used for authentication but remain visible in your API Keys list for reference.

Open OAuth client details

Click on the OAuth client name in the API Keys table to view its details.

Revoke the client

In the client details panel, click Revoke Key.

Revoking a client will immediately disable it. Any applications or integrations using this client will stop working until you create and configure a new client.

Confirm revocation

Confirm that you want to revoke the client. The client’s status will change to “Revoked” in the API Keys table.

Next steps

Proxy API documentation

Create ledger records via Cloud APIs.

Filters API documentation

Filter live ledger data.

Data lake API documentation

Historical SQL over an instance lake.

Need help?

We are very happy to help you make the most of Blnk, regardless of whether it is your first time or you are switching from another tool. To ask questions or discuss issues, please contact us or join our Discord community.

Start Here

Deployments

Proxy & data

Data lake

AI integrations

Audit

Alerts

Billing

Create an OAuth client

Get an access token

Use the access token with Cloud APIs

Revoke an OAuth client

Next steps

Proxy API documentation

Filters API documentation

Data lake API documentation

Need help?

​Create an OAuth client

​Get an access token

​Use the access token with Cloud APIs

​Revoke an OAuth client

​Next steps

Proxy API documentation

Filters API documentation

Data lake API documentation

​Need help?

Create an OAuth client

Get an access token

Use the access token with Cloud APIs

Revoke an OAuth client

Next steps

Need help?