Skip to main content

​
How keys work

  • Each billing plan of a project comes with one key: one for its subscription, or one for pay-as-you-go. The key carries the plan’s limits (requests per second, balance or allowance).
  • Keys look like bl_live_ followed by 32 characters.
  • A key is shown once, when it’s created. Bloklake stores only a hash of it; nobody, including us, can show it again.
  • One key works on every chain.
  • Sets and prepared queries belong to the project, so every key of the project shares them, and a rotated key keeps working with them.
The API keys page

​
Sending the key

Authorization: Bearer <key> is preferred. x-api-key: <key> and X-BL-Api-Key: <key> work too. Keys are only accepted in headers, never in the URL. /status, /v1/schema and /healthz don’t need a key. GET /v1/account takes a key but is free: use it to check a key’s plan, limit and balance.

​
Rotating a key

On API keys, Rotate issues a new key on the same plan and revokes the old one at once: requests still using it get 401 key_revoked until you switch them to the new key. The new key is shown once; copy it before closing the dialog. Have the new key’s deployment ready before you rotate, or rotate when a short interruption is acceptable. If a key leaked, rotate right away.

​
Deleting a key

Delete revokes the key immediately; requests with it get 401 key_revoked. On pay-as-you-go, deleting the key is also how you switch the project to a subscription; see Subscriptions.

​
Key status

​
Per-key analytics

Click a key to see its current request rate against its limit, data and spend for 24 hours and 30 days, and its charts by chain. The key list shows when each key was last used.
A key's analytics page

​
Keeping keys safe

  • Never put a key in a browser, mobile app or public repository. Anyone with it can spend your balance or allowance. Call Bloklake from your servers. (The API doesn’t send CORS headers, so browsers can’t call it directly anyway.)
  • Keep keys in a secret manager or environment variables, not in code.
  • Give each service its own project if you want separate keys, limits and usage.
  • If a key leaks, rotate it right away.