> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blips.network/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How BLIPS credentials map into the first public API contract and the Mintlify Playground.

# Authentication

BLIPS API tokens are credential pairs.

Each token consists of:

* `clientId`
* `clientSecret`

Requests are sent using HTTP Basic Auth.

In practical terms:

* Basic Auth username = `clientId`
* Basic Auth password = `clientSecret`

This is the core authentication model for the current public BLIPS API contract.

`clientSecret` is only returned on token creation.

That means the token create flow is the one point where the full credential pair is revealed. Subsequent token list, detail, and revoke surfaces should be treated as management/readback operations and not as secret-retrieval surfaces.

In the current OpenAPI copy, this is defined as the `BasicAuth` security scheme and applied globally across the public contract.

## What this means for Mintlify

Once the docs site is deployed through Mintlify:

* API Reference pages will show the authentication requirement automatically.
* Playground forms expose the corresponding Basic Auth input.
* Endpoint pages inherit the security requirement from the OpenAPI document unless an operation overrides it.

## Public Test Environment

The current public docs and Try It surface are bound to the Public Test Backend at:

```text theme={null}
https://public-test.blips.network
```

The docs should describe BLIPS credentials as a token pair, not as a single opaque string.

* Public Playground requests authenticate with platform tokens only.
* `INTERNAL_API_KEY` is operator-only and is never a public fallback.
* Public Test credentials should be treated as internet-testable credentials for the retained public API ring.

This pass does not describe the Public Test Environment as production-ready.

## Auth-adjacent surfaces

The public API also includes token-management endpoints. Those routes are part of the authenticated API surface and should remain documented in the generated reference rather than being duplicated manually here.

That means this page should explain:

* what a BLIPS API token actually is
* how `clientId + clientSecret` map into Basic Auth
* that `clientSecret` is only returned on token creation
* that current public Try It requests go to the Public Test Backend
* that public Playground auth uses platform tokens and not operator credentials