Credentials & test sessions

Blink issues your client credentials when your integration agreement is in place. This page covers what you receive, where each credential may be used, and how to test before writing code.

What you receive

Credential	Looks like	Where it lives
Client key	`bkyc_live_…`	Your backend only.
Client secret	`bksec_…`	Your backend's secret store only.
SDK packages	Android, iOS, Web, Flutter, React Native	Access is set up with your credentials.

The session token (bkyc_sess_…) is not a credential you are issued: your backend creates one per verification with the Session API.

Never

Put the client key or secret in a mobile app, a web page, a QR code or source control. Anything shipped to a device can be extracted. If a secret is exposed, contact Blink to replace it.

Storing them

Load them from environment variables or a secret manager, e.g. BLINK_CLIENT_KEY and BLINK_CLIENT_SECRET.
Keep separate credentials for testing and production, and never point a test build at production.
Restrict who can read them to the service that calls Blink.

Web origins

Browser calls are fail-closed: the Web SDK only works from origins registered on your client — for example https://app.yourbank.com. Tell Blink each origin you will serve the SDK from. For a single session you can also narrow it further with originAllowlist when you create the session. Native apps and server-to-server calls are not affected.

Test sessions

The client dashboard can create a test session for you and show it as a QR code, so you can try the full capture on a phone before building your backend:

Open Integration testing › Generate test session in the dashboard.
Scan the QR with the phone camera to open the hosted page, or with a test app built on the SDK.
Complete the document and liveness steps and read the decision.

The QR holds a hosted link such as https://kyc-api.blink-pay.net/h/?t=bkyc_sess_…. Each test session is single-use and billed like a live one — generate a fresh QR for every run.