Skip to main content
The Access Protocol uses an asymmetric keypair on the secp256k1 curve. You generate the keypair locally; only the public half ever leaves your environment.
Curve choice. secp256k1 is the default and the curve used in every command on this page, but the signing curve is part of your onboarding agreement — it is registered together with your public key. If Bloobank assigned a different curve, substitute it in the commands below; everything else stays identical. Mismatched curves fail signature verification before any other check.

​
Step 1 — Install OpenSSL

OpenSSL ships preinstalled on macOS and most Linux distributions. On Windows, install the version that ships with Git for Windows or grab a build from openssl.org.

​
Step 2 — Generate the private key

This writes privateKey.pem to your working directory.
The private key is your secret. Never commit it, never paste it into chat, never send it — not even to Bloobank. Store it in a secret manager (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault, Doppler) or an encrypted environment variable. Add *.pem and .env to .gitignore from the start.

​
Step 3 — Export the public key (PEM or hex)

Bloobank accepts the public key in either format — a standard PEM file or a flat hexadecimal string. Pick whichever fits your tooling; both register the same key.

​
Option A — PEM (one command)

Derive the public key straight from the private key:
Sample publicKey.pem:
Register the file contents exactly as emitted — header, footer, and line breaks included.

​
Option B — Flat hex

Dump the PEM as text and extract both halves:
Sample output:
Strip colons and newlines to get flat hex strings:
Example public key (valid format — 130 hex chars, uncompressed, leading 04):

​
Step 4 — Register the public key

1

Copy the public key

Either the publicKey.pem file contents (Option A) or the 130-character hex string starting with 04 (Option B) — both formats are accepted.
2

Send it to your Bloobank integration contact

Share the public key through the channel established during onboarding. Never share the private key — only the public half is needed.
3

Receive your Access Key

Bloobank registers the public key and returns an Access Key. Store it together with your private key (PEM or hex — whichever your signing client consumes) in your secret store — both are required to sign requests.
You now have three secrets to manage: the private key (most sensitive), the Access Key (sensitive — identifies you), and the public key (not sensitive, but worth keeping near the others for reference).

​
Per-environment separation

Use distinct keypairs for sandbox, staging, and production. Never reuse a staging key in production. A compromise in one environment must not cascade.

​
Rotation

Rotate keys every 6–12 months, or immediately if you suspect compromise:
  1. Generate a new keypair on the new environment.
  2. Send the new public key to Bloobank; you will receive a new Access Key.
  3. Cut over traffic to the new credential.
  4. Request revocation of the old credential.
There is no in-place key rotation — every rotation produces a new Access Key. This is intentional: revocation is unambiguous.

​
Next

Sign a request

Use the keypair you just generated to sign your first authenticated request.