Skip to main content
External integrations and MCP clients authenticate to the Blueprints API with a bp_ API key:
The web app uses a session cookie set by the in-product login flow. That cookie is browser-only — every programmatic caller (scripts, backends, MCP clients, scheduled jobs) must use an API key.

​
API keys

API keys are scoped. A key can be broad enough to run a full MCP workflow, or narrow enough to only read blueprints or portfolio data. Treat a bp_ key like a production credential: keep it server-side or inside trusted local MCP client configuration. Do not ship it in browser code, mobile apps, public repos, synced dotfiles, or frontend bundles. Use API keys for:
  • Remote MCP clients
  • Backend services that read or update blueprints
  • Internal tools that monitor orders, portfolio state, or risk rules
  • Scheduled jobs that need account-scoped access
API keys are not shown again after creation. Store the key in your secret manager or local MCP client config immediately.

​
API key scopes

Use explicit scopes for integrations. API keys cannot create other API keys, even when they have key-management scopes. Key creation requires an interactive web session in the Blueprints app.

​
Managing keys

Create keys from the Blueprints app at useblueprints.ai. Listing keys requires api_keys:read. Revoking keys through the API requires api_keys:write, but API keys are never accepted by the create-key endpoint. When rotating a key:
  1. Create a replacement key in the app.
  2. Update the integration or MCP client configuration.
  3. Confirm the new key works.
  4. Revoke the old key.

​
Common auth failures