Blockchain.com · Authentication Profile

Blockchain.Com Authentication

Authentication

Blockchain.com secures its APIs with apiKey and oauth2 across 5 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the bearer token (authorization endpoints not publicly documented) flow(s).

cryptocurrencybitcoinblockchainexchangetradingmarket-datapaymentson-rampwalletblock-explorerfintechwebhooks
Methods: apiKey, oauth2 Schemes: 5 OAuth flows: bearer token (authorization endpoints not publicly documented) API key in: header

Security Schemes

ApiKeyAuth apiKey
· in: header (X-API-Token)
PublicApiKeyAuth apiKey
· in: header (X-Public-API-Key)
PrivateApiKeyAuth apiKey
· in: header (X-Private-API-Key)
OAuth2 Bearer oauth2
· in: header (Authorization)
WebSocket auth channel apiKey
· in: message (token)

Source

Authentication Profile

Raw ↑ 
generated: '2026-08-02'
method: searched
source: openapi/blockchain.com-exchange-openapi.yml, openapi/blockchain.com-pay-partner-api-openapi.yml
docs: >-
  https://api.blockchain.com/v3/,
  https://docs.blockchain.com/pay/api/partner-api/authentication,
  https://docs.blockchain.com/oauth-resources
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - bearer token (authorization endpoints not publicly documented)
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: X-API-Token
  sources:
  - openapi/blockchain.com-exchange-openapi.yml
- name: PublicApiKeyAuth
  type: apiKey
  in: header
  parameter: X-Public-API-Key
  description: Partner's public API key. Required on all endpoints to identify the partner.
  sources:
  - openapi/blockchain.com-pay-partner-api-openapi.yml
- name: PrivateApiKeyAuth
  type: apiKey
  in: header
  parameter: X-Private-API-Key
  description: Partner's private API key. Required on order endpoints; indicates a server-to-server
    call.
  sources:
  - openapi/blockchain.com-pay-partner-api-openapi.yml
- name: OAuth2 Bearer
  type: oauth2
  in: header
  parameter: Authorization
  token_type: bearer
  resource_server: https://api.blockchain.info/partner-resource-gateway
  scopes:
  - read_transactions
  - read_balance
  scopes_artifact: scopes/blockchain.com-scopes.yml
  description: >-
    OAuth 2.0 resource gateway for reading a consenting user's Blockchain.com
    custodial wallet transactions and balances. Documented only in prose; no
    OpenAPI and no RFC 8414 / RFC 9728 discovery document is published.
  sources:
  - https://docs.blockchain.com/oauth-resources/oauth-resources.md
- name: WebSocket auth channel
  type: apiKey
  in: message
  parameter: token
  description: >-
    Exchange WebSocket clients authenticate by subscribing to the `auth` channel
    with the API secret in a `token` field, or by presenting an auth_token cookie
    header on connect.
  sources:
  - https://exchange.blockchain.com/api/
notes:
- >-
  No OpenID Connect, no mutualTLS and no HTTP basic anywhere in the public
  surface. The blockchain.info Data, Simple Query, Charts and Exchange Rates APIs
  are entirely unauthenticated.