Get EnterpriseOpen Dashboard

API keys

Create API key

Create a new API key with fine-grained permissions.

POST/api-keys

API keys allow you to enforce access control by granting specific scopes (permissions) to different services or applications, rather than using the master key for all operations.

Authorization

If set, the API uses an API key for authentication. Include the following header in your requests: X-blnk-key: <api-key>.

Replace <api-key> with your secret API key. Ensure the key is kept secure and not exposed in public repositories or client-side code.

See also: Core API key.

Body

namestringrequiredbody

The name of the API key or service account. Use descriptive names to identify the purpose of each key.

ownerstringrequiredbody

Unique identifier of the owner or service associated with the API key, provided by you. This helps track which service or team owns each key. You can use any string value that identifies the owner (e.g., team name, service name, user ID).

scopesarrayrequiredbody

A list of permissions granted to the API key. Each scope follows the format resource:action. See Understanding Scopes for available resources and actions.

Examples:

  • ["ledgers:read"] - Can only view ledgers
  • ["transactions:write", "balances:read"] - Can create/modify transactions and view balances
  • ["*:*"] - Full access to all resources and actions
expires_atstringrequiredbody

The expiration date and time for the API key in ISO 8601 format (e.g., "2026-03-11T00:00:00Z").

Response

api_key_idstring

Unique identifier for the created API key.

keystring

The actual API key value. Store this securely as it will not be shown again. Use this value in the X-Blnk-Key header for authenticated requests.

namestring

The name of the API key.

owner_idstring

The owner identifier associated with the API key.

scopesarray

List of permissions granted to the API key.

expires_atstring

The expiration date and time for the API key in ISO 8601 format.

created_atstring

ISO 8601 formatted timestamp of when the API key was created.

last_used_atstring

ISO 8601 formatted timestamp of when the API key was last used for authentication. Returns "0001-01-01T00:00:00Z" if the key has never been used.

is_revokedboolean

Whether the API key has been revoked. Returns false for newly created keys.