Authentication

All BLOX merchant API requests require authentication. This section covers how to authenticate your API requests securely.

Wallet, Onramp (Checkout), and Payout share the same wire format. Payout has a slightly different freshness / replay policy — see Payout differences.

Overview

BLOX uses a two-layer authentication approach:

API Key - Identifies your application and grants access to the API.
Request Signature - Protects state-changing requests (POST, PUT, etc.) from tampering using RFC 9421 HTTP Message Signatures.

Authentication Methods

API Keys

Learn how to obtain and use your blox-api-key for authentication.

Request Signing

Secure your state-changing requests with digital signatures (RFC 9421).

Quick Reference

Required Headers

Header	Required	Description
`blox-api-key`	Always	Your API key (secret)
`Content-Type`	With Body	Set to `application/json`
`Signature`	State-changing	RFC 9421 cryptographic signature
`Signature-Input`	State-changing	Metadata for the signature
`Content-Digest`	With Body	RFC 9421 digest of the request body

Example Request (Read-only)

curl "https://api.blox.my/v1/health" \
  -H "blox-api-key: YOUR_API_KEY"

Next Steps

Get API Keys — contact the BLOX team to enable access.
Learn request signing for secure API calls.
Test in Sandbox before going live.