Authentication

Blink uses two kinds of credential, one for each side of the trust boundary. Your backend authenticates with the client key and secret; the device authenticates with a short-lived session token.

base URL https://kyc-api.blink-pay.net format JSON over HTTPS

Credentials

Credential	Used by	Sent as	Endpoints
Client key + secret	Your backend	JSON body fields `clientKey`, `clientSecret`	Session API
Client key + secret	Your backend	Headers `X-Blink-Client-Key`, `X-Blink-Client-Secret`	Result API, Documents API
Session token	The SDK or hosted page	`Authorization: Bearer bkyc_sess_…`	Device API

Backend calls

Result APIhttp

GET /api/blink/session/{sessionId}/result HTTP/1.1
Host: kyc-api.blink-pay.net
X-Blink-Client-Key: bkyc_live_…
X-Blink-Client-Secret: bksec_…

Wrong credentials on the Result API return 404, the same as an unknown session, so sessions cannot be probed.

Device calls

Device APIhttp

POST /api/sdk/document/challenge HTTP/1.1
Host: kyc-api.blink-pay.net
Authorization: Bearer bkyc_sess_…

A missing, expired or used session token returns 401 with BLINK_SESSION_INVALID. The fix is always a new session.

Rules

The client secret is only ever sent from your servers.
One session token per verification attempt; don't cache or reuse them.
Treat a session token like a password while it is valid — don't log it or put it in analytics.