Authentication
All BLOX API requests require authentication. This section covers how to authenticate your API requests securely.
Overview
BLOX uses a two-layer authentication approach:
- API Key - Identifies your application and grants access to the API.
- Request Signature - Protects state-changing requests (POST, PUT, etc.) from tampering using RFC 9421 HTTP Message Signatures.
Authentication Methods
Quick Reference
Required Headers
| Header | Required | Description |
|---|---|---|
blox-api-key | Always | Your API key (secret) |
Content-Type | With Body | Set to application/json |
Signature | State-changing | RFC 9421 cryptographic signature |
Signature-Input | State-changing | Metadata for the signature |
Content-Digest | With Body | RFC 9421 digest of the request body |
Example Request (Read-only)
curl "https://api.blox.my/v1/health" \
-H "blox-api-key: YOUR_API_KEY"Next Steps
- Get your API Keys from the Business Portal.
- Learn Request Signing for secure API calls.
- Test in Sandbox before going live.
Last updated