Skip to main content

​
Authentication

BLIPS API tokens are credential pairs. Each token consists of:
  • clientId
  • clientSecret
Requests are sent using HTTP Basic Auth. In practical terms:
  • Basic Auth username = clientId
  • Basic Auth password = clientSecret
This is the core authentication model for the current public BLIPS API contract. clientSecret is only returned on token creation. That means the token create flow is the one point where the full credential pair is revealed. Subsequent token list, detail, and revoke surfaces should be treated as management/readback operations and not as secret-retrieval surfaces. In the current OpenAPI copy, this is defined as the BasicAuth security scheme and applied globally across the public contract.

​
What this means for Mintlify

Once the docs site is deployed through Mintlify:
  • API Reference pages will show the authentication requirement automatically.
  • Playground forms expose the corresponding Basic Auth input.
  • Endpoint pages inherit the security requirement from the OpenAPI document unless an operation overrides it.

​
Public Test Environment

The current public docs and Try It surface are bound to the Public Test Backend at: 
https://public-test.blips.network
The docs should describe BLIPS credentials as a token pair, not as a single opaque string.
  • Public Playground requests authenticate with platform tokens only.
  • INTERNAL_API_KEY is operator-only and is never a public fallback.
  • Public Test credentials should be treated as internet-testable credentials for the retained public API ring.
This pass does not describe the Public Test Environment as production-ready.

​
Auth-adjacent surfaces

The public API also includes token-management endpoints. Those routes are part of the authenticated API surface and should remain documented in the generated reference rather than being duplicated manually here. That means this page should explain:
  • what a BLIPS API token actually is
  • how clientId + clientSecret map into Basic Auth
  • that clientSecret is only returned on token creation
  • that current public Try It requests go to the Public Test Backend
  • that public Playground auth uses platform tokens and not operator credentials