Blockchain.com · Authentication Profile

Blockchain.Com Authentication

Authentication

Blockchain.com secures its APIs with apiKey and oauth2 across 5 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the bearer token (authorization endpoints not publicly documented) flow(s).

CryptocurrencyBitcoinBlockchainExchangeTradingMarket DataPaymentsOn-RampWalletsBlock ExplorerFintechWebhook
Methods: apiKey, oauth2 Schemes: 5 OAuth flows: bearer token (authorization endpoints not publicly documented) API key in: header

Security Schemes

ApiKeyAuth apiKey
· in: header (X-API-Token)
PublicApiKeyAuth apiKey
· in: header (X-Public-API-Key)
PrivateApiKeyAuth apiKey
· in: header (X-Private-API-Key)
OAuth2 Bearer oauth2
· in: header (Authorization)
WebSocket auth channel apiKey
· in: message (token)

Source

Authentication Profile

Raw ↑ 
generated: '2026-08-02'
method: searched
source: openapi/blockchain.com-exchange-openapi.yml, openapi/blockchain.com-pay-partner-api-openapi.yml
docs: >-
  https://api.blockchain.com/v3/,
  https://docs.blockchain.com/pay/api/partner-api/authentication,
  https://docs.blockchain.com/oauth-resources
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - bearer token (authorization endpoints not publicly documented)
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: X-API-Token
  sources:
  - openapi/blockchain.com-exchange-openapi.yml
- name: PublicApiKeyAuth
  type: apiKey
  in: header
  parameter: X-Public-API-Key
  description: Partner's public API key. Required on all endpoints to identify the partner.
  sources:
  - openapi/blockchain.com-pay-partner-api-openapi.yml
- name: PrivateApiKeyAuth
  type: apiKey
  in: header
  parameter: X-Private-API-Key
  description: Partner's private API key. Required on order endpoints; indicates a server-to-server
    call.
  sources:
  - openapi/blockchain.com-pay-partner-api-openapi.yml
- name: OAuth2 Bearer
  type: oauth2
  in: header
  parameter: Authorization
  token_type: bearer
  resource_server: https://api.blockchain.info/partner-resource-gateway
  scopes:
  - read_transactions
  - read_balance
  scopes_artifact: scopes/blockchain.com-scopes.yml
  description: >-
    OAuth 2.0 resource gateway for reading a consenting user's Blockchain.com
    custodial wallet transactions and balances. Documented only in prose; no
    OpenAPI and no RFC 8414 / RFC 9728 discovery document is published.
  sources:
  - https://docs.blockchain.com/oauth-resources/oauth-resources.md
- name: WebSocket auth channel
  type: apiKey
  in: message
  parameter: token
  description: >-
    Exchange WebSocket clients authenticate by subscribing to the `auth` channel
    with the API secret in a `token` field, or by presenting an auth_token cookie
    header on connect.
  sources:
  - https://exchange.blockchain.com/api/
notes:
- >-
  No OpenID Connect, no mutualTLS and no HTTP basic anywhere in the public
  surface. The blockchain.info Data, Simple Query, Charts and Exchange Rates APIs
  are entirely unauthenticated.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/blockchain.com-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.