🔑Authentication

The OffBlocks API utilises the Bearer authentication mechanism. Before accessing any of the authenticated endpoints, you must obtain an authentication token by providing your client credentials: apiKey and apiSecret. This process is automatically handled for all requests in our Postman collection.

Retrieving an Authentication Token

The endpoint mentioned above returns a JSON Web Token (JWT) token. You must include this token as a Bearer token in the header of all requests that require authentication. Additionally, the response includes an expiration timestamp for the token, measured in seconds.

Initial Authentication

Retrieve authentication token using API credentials

POSThttps://api.offblocks.xyz/v1/auth/token

Body

application/json

apiKey*string (uuid)

Unique API key used to identify your API integration. Note this can be different for live and sandbox environments

apiSecret*string

API secret

Response

200400401500

Successful operation

Body

application/json

token*string

JWT token that can be used for further requests to authenticated endpoints

expiresAt*integer

token expiration time (UNIX timestamp)

tokenType*string

token type. Must be "Bearer"

Request

JavaScriptCurlPython

const response = await fetch('https://api.offblocks.xyz/v1/auth/token', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "apiKey": "123e4567-e89b-12d3-a456-426614174000",
      "apiSecret": "text"
    }),
});
const data = await response.json();

Response

200

{
  "token": "text",
  "expiresAt": 0,
  "tokenType": "text"
}

Changing Stored Credentials

Should you suspect that your credentials have been compromised, you can update them using the following endpoint:

Update API credentials

Add or update API credentials. If credentials are updated this action invalidates all issued tokens and active sessions

PUThttps://api.offblocks.xyz/v1/auth/credentials

Authorization

bearerAuth

Body

application/json

apiKey*string (uuid)

Unique API key used to identify your API integration. Note this can be different for live and sandbox environments

apiSecret*string

API secret

Response

204400401500

Successful operation

Request

JavaScriptCurlPython

const response = await fetch('https://api.offblocks.xyz/v1/auth/credentials', {
    method: 'PUT',
    headers: {
      "Authorization": "Bearer JWT",
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "apiKey": "123e4567-e89b-12d3-a456-426614174000",
      "apiSecret": "text"
    }),
});
const data = await response.json();

This endpoint allows you to replace your current apiKey and apiSecret with new, more secure credentials.

Removing API Credentials

If necessary, you can completely remove your API credentials by using the following endpoint:

Delete API credentials

Delete existing API credentials. This invalidates all issued tokens and active sessions

DELETEhttps://api.offblocks.xyz/v1/auth/credentials

Authorization

bearerAuth

Body

application/json

apiKey*string (uuid)

Unique API key used to identify your API integration. Note this can be different for live and sandbox environments

Response

204400401500

Successful operation

Request

JavaScriptCurlPython

const response = await fetch('https://api.offblocks.xyz/v1/auth/credentials', {
    method: 'DELETE',
    headers: {
      "Authorization": "Bearer JWT",
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "apiKey": "123e4567-e89b-12d3-a456-426614174000"
    }),
});
const data = await response.json();

Please exercise caution when using this endpoint, as it will permanently revoke your access to the OffBlocks API.