API Keys

Contact the BLOX team to enable API key access for your account (sandbox and production). API keys authenticate your requests; each key is tied to your account and a registered signer public key.

[!IMPORTANT] When your API key is created, you must provide a signing public key. It is used to verify signatures on all state-changing requests (POST, PUT, PATCH, DELETE).

Key facts

Fact	Detail
Format	Keys start with `blox_pk_`
Display	The secret is shown once at creation — store it securely
Active keys	Up to 5 active keys per account
Signer algorithms	`ed25519`, `ecdsa-p256-sha256`, `ecdsa-secp256k1-sha256`

Environments

Sandbox keys — for development and testing against api.sandbox.blox.my
Production keys — for live traffic against api.blox.my

Contact the BLOX team for both.

Authentication Methods

Header Authentication

Prefer the blox-api-key header:

curl https://api.sandbox.blox.my/v1/health \
  -H "blox-api-key: YOUR_API_KEY"

Authorization: Bearer YOUR_API_KEY is also accepted.

Request Headers

Header	Required	Description
`blox-api-key`	Yes (or Bearer)	Your API key secret
`Content-Type`	Yes (for JSON bodies)	`application/json`
`Content-Digest`	Yes (signed requests with body)	`sha-256=:BASE64:` of canonicalized body
`Signature-Input`	Yes (POST/PUT/PATCH/DELETE)	RFC 9421 signature metadata
`Signature`	Yes (POST/PUT/PATCH/DELETE)	RFC 9421 signature

GET requests need only the API key. Write methods require a signature — see Request Signature.

Testing Authentication

curl https://api.sandbox.blox.my/v1/health \
  -H "blox-api-key: YOUR_API_KEY"

{
  "success": true,
  "message": "API key is valid",
  "account": {
    "id": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416",
    "name": "Your Business Name",
    "type": "BUSINESS",
    "status": "ACTIVE"
  }
}