BlooBank API Documentation

The Access Protocol uses an asymmetric keypair on the secp256k1 curve. You generate the keypair locally; only the public half ever leaves your environment.

Step 1 — Install OpenSSL

OpenSSL ships preinstalled on macOS and most Linux distributions. On Windows, install the version that ships with Git for Windows or grab a build from openssl.org.

openssl version
# LibreSSL 3.3.6  or  OpenSSL 3.x.x

Step 2 — Generate the private key

openssl ecparam -name secp256k1 -genkey -out privateKey.pem

This writes privateKey.pem to your working directory.

The private key is your secret. Never commit it, never paste it into chat, never send it — not even to BlooBank. Store it in a secret manager (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault, Doppler) or an encrypted environment variable. Add *.pem and .env to .gitignore from the start.

Step 3 — Extract the key pair in hex

BlooBank expects the public key in hexadecimal. Dump the PEM as text and extract both halves:

openssl ec -in privateKey.pem -noout -text

Sample output:

Private-Key: (256 bit)
priv:
    7c:d5:f4:99:a5:fd:de:62:83:09:96:96:b8:8b:51:
    70:e4:8d:85:ab:23:eb:58:bf:c0:e4:99:6b:ac:0c:
    3f:76
pub:
    04:94:cc:f0:38:2d:a3:c3:21:f5:cb:e8:59:06:8c:
    8c:91:4d:6a:d5:ce:17:ab:3d:26:a9:dd:7f:ff:65:
    78:cb:31:62:e0:75:af:bd:98:45:96:4a:0c:13:e4:
    39:ae:53:78:30:49:8f:ef:58:79:45:59:7e:97:0a:
    b2:7c:14:7c:23
ASN1 OID: secp256k1

Strip colons and newlines to get flat hex strings:

# Private key (32 bytes → 64 hex chars)
openssl ec -in privateKey.pem -noout -text 2>/dev/null \
  | awk '/priv:/{flag=1; next} /pub:/{flag=0} flag' \
  | tr -d ' :\n'

# Public key (uncompressed, 65 bytes → 130 hex chars, starts with 04)
openssl ec -in privateKey.pem -noout -text 2>/dev/null \
  | awk '/pub:/{flag=1; next} /ASN1/{flag=0} flag' \
  | tr -d ' :\n'

import { execSync } from "node:child_process";

const txt = execSync("openssl ec -in privateKey.pem -noout -text", {
  stdio: ["ignore", "pipe", "ignore"],
}).toString();

const grab = (start, end) =>
  txt.split(start)[1].split(end)[0].replace(/[\s:]/g, "");

const privHex = grab("priv:", "pub:");
const pubHex  = grab("pub:", "ASN1 OID");

console.log({ privHex, pubHex });

import re, subprocess

out = subprocess.check_output(
    ["openssl", "ec", "-in", "privateKey.pem", "-noout", "-text"],
    stderr=subprocess.DEVNULL,
).decode()

def grab(start, end):
    chunk = out.split(start, 1)[1].split(end, 1)[0]
    return re.sub(r"[\s:]", "", chunk)

priv_hex = grab("priv:", "pub:")
pub_hex  = grab("pub:", "ASN1 OID")
print({"priv": priv_hex, "pub": pub_hex})

Example public key (valid format — 130 hex chars, uncompressed, leading 04):

0494ccf0382da3c321f5cbe859068c8c914d6ad5ce17ab3d26a9dd7fff6578cb3162e075afbd9845964a0c13e439ae537830498fef587945597e970ab27c147c23

Step 4 — Register the public key

Copy the public key hex

The 130-character string starting with 04 from Step 3.

Send it to your BlooBank integration contact

Share the public key through the channel established during onboarding. Never share the private key — only the public half is needed.

Receive your Access Key

BlooBank registers the public key and returns an Access Key. Store it together with your private-key hex in your secret store — both are required to sign requests.

You now have three secrets to manage: the private key (most sensitive), the Access Key (sensitive — identifies you), and the public key (not sensitive, but worth keeping near the others for reference).

Per-environment separation

Use distinct keypairs for sandbox, staging, and production. Never reuse a staging key in production. A compromise in one environment must not cascade.

Rotation

Rotate keys every 6–12 months, or immediately if you suspect compromise:

Generate a new keypair on the new environment.
Send the new public key to BlooBank; you will receive a new Access Key.
Cut over traffic to the new credential.
Request revocation of the old credential.

There is no in-place key rotation — every rotation produces a new Access Key. This is intentional: revocation is unambiguous.

Sign a request

Use the keypair you just generated to sign your first authenticated request.

Introduction

Concepts

Authentication

Errors

Wallets

Payments

Generate your keys

Step 1 — Install OpenSSL

Step 2 — Generate the private key

Step 3 — Extract the key pair in hex

Step 4 — Register the public key

Per-environment separation

Rotation

Next

Sign a request

​Step 1 — Install OpenSSL

​Step 2 — Generate the private key

​Step 3 — Extract the key pair in hex

​Step 4 — Register the public key

​Per-environment separation

​Rotation

​Next

Sign a request

Step 1 — Install OpenSSL

Step 2 — Generate the private key

Step 3 — Extract the key pair in hex

Step 4 — Register the public key

Per-environment separation

Rotation

Next