Authentication

Every authenticated request to the Blaick API carries a Bearer token in the Authorization header:

Authorization: Bearer <token>

There are two kinds of token, and they go in the exact same header:

Token type	Prefix	Best for	Lifetime
API key	blk_	Servers, scripts, integrations	Until you revoke it
JWT	—	Interactive/user sessions	Short-lived; obtained at login

For most integrations, use an API key. JWTs are primarily for user-facing sessions obtained through login/SSO.

API keys

API keys are the recommended credential for backend and automation use. They start with blk_ and never expire until you revoke them.

Create a key

Sign in to your Blaick account and create an API key from the dashboard. An API key looks like this:

blk_a1b2c3d4e5f6g7h8i9j0

The full key appears only once

The full key is shown only once, at creation time. It is stored hashed on our side and can never be retrieved again. Copy it into a secret manager immediately. If it leaks or you lose it, revoke it and create a new one.

Set it as an environment variable so the examples below work as-is:

export BLAICK_API_KEY="blk_a1b2c3d4e5f6g7h8i9j0"

Use a key

Send it as a Bearer token, exactly like any other:

curl https://api.blaick.ai/api/v1/models \
  -H "Authorization: Bearer $BLAICK_API_KEY"

List your keys

Returns metadata only — never the full key. You'll see the prefix and when each key was last used.

curl https://api.blaick.ai/api/v1/users/me/api-keys \
  -H "Authorization: Bearer $BLAICK_API_KEY"

[
  {
    "id": "a1a1a1a1-2b2b-4c4c-8d8d-9e9e9e9e9e9e",
    "name": "My Integration Key",
    "prefix": "blk_a1b2",
    "is_active": true,
    "created_at": "2026-08-04T00:00:00Z",
    "last_used_at": "2026-08-04T10:15:00Z"
  }
]

Revoke a key

curl -X DELETE https://api.blaick.ai/api/v1/users/me/api-keys/{key_id} \
  -H "Authorization: Bearer $BLAICK_API_KEY"

Revocation takes effect immediately. Rotate keys by creating the new one first, deploying it, then revoking the old one.

Verifying a key

To check whether a key is valid without making a full request, use the verify endpoint:

curl https://api.blaick.ai/api/v1/auth/verify-api-key \
  -H "Content-Type: application/json" \
  -d '{"key": "blk_a1b2c3d4e5f6g7h8i9j0"}'

{ "valid": true, "user_id": "…", "email": "you@example.com", "role": "user" }

JWTs (session tokens)

Interactive sessions authenticate through login or SSO and receive a short-lived JWT:

curl https://api.blaick.ai/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "••••••••"}'

{ "access_token": "eyJhbGciOi...", "token_type": "bearer", "user": { "id": "…", "email": "you@example.com" } }

Send access_token as Authorization: Bearer eyJhbGciOi.... JWTs expire; for anything long-running, prefer an API key.

Security best practices

• Never commit keys to source control. Use environment variables or a secret manager.
• One key per integration. Separate keys make it painless to revoke a single compromised integration.
• Rotate periodically, and immediately if a key may have been exposed.
• Scope access by account — a key inherits the permissions and token balance of the account that created it.
• Always use HTTPS. Requests over plain HTTP are rejected.