Authentication

The Blond API uses personal API keys to authenticate incoming requests. You can view and manage your API keys in the User Settings. Your API keys carry the same permissions as your regular user account, so be sure to keep them secure!

To authenticate API calls, you always need to set a Authorization header with your API key as a Bearer token:

Authorization: Bearer [YOUR-API-KEY]

Important

An API key acts as your user in a specific organization. You cannot access multiple organizations with a single key.

OAuth for MCP clients

AI clients connecting to the Blond MCP server (/api/mcp) can authenticate via OAuth 2.1 instead of an API key. This is the recommended method for MCP clients like Claude, ChatGPT or Claude Code — the client opens a browser window where you sign in to Blond and approve access, no manual key handling required.

The OAuth server supports:

• Discovery via /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource
• Dynamic client registration (RFC 7591) via POST /oauth/register — public clients with PKCE only
• Authorization code grant with PKCE via /oauth/authorize and /oauth/token
• Refresh tokens — access tokens expire after 1 hour and are refreshed automatically by the client

MCP clients that implement the Model Context Protocol authorization spec pick all of this up automatically; you only need to provide the server URL.

Important

Like an API key, an OAuth connection is pinned to one organization: the organization you were working in when you approved the consent screen. To connect a different organization, switch organizations in the Blond app first, then connect again.

You can review and revoke connected apps at any time under Connected apps in the User Settings. Revoking a connection invalidates all of its access and refresh tokens immediately.

The REST API itself continues to use personal API keys — OAuth tokens are currently only accepted by the MCP endpoint.