Get started
Authentication
Every request authenticates with a bearer token. No OAuth dance, no signed requests — just an API key in a header.
Bearer keys#
Send your key in the Authorization header on every call to the REST API and the MCP server. Live keys are prefixed blp_live_.
Create, rotate & revoke#
- Create keys in the dashboard. Your plan sets how many keys you can hold at once.
- Rotate by creating a new key, deploying it, then revoking the old one — zero downtime.
- Revoke instantly from the dashboard. A revoked key stops working on the next request.
Keep keys secret. Never ship a blp_live_ key in client-side code, a public repo, or a browser bundle. Load it from an environment variable or a secrets manager, and call Blopus from your backend.
What auth failures look like#
A missing, malformed, or revoked key returns a clean 401: