Skip to main content

​
Authentication

BKey is a standards-compliant OAuth 2.1 / OIDC / CIBA (RFC 8958) issuer. You can use BKey through our SDK (fastest) or talk to the standard endpoints directly from any OIDC-aware library. See Integrate BKey for the full integrator-facing tour of our endpoints — discovery, JWKS, CIBA, x402/MPP authorize, vault, checkout.

​
Grant Types

BKey supports three OAuth 2.1 grant types, each designed for a different use case.

​
Token Format

BKey issues JWTs signed with EdDSA (Ed25519). Tokens include:
  • sub — the user or client DID
  • scope — granted scopes
  • exp — expiration timestamp
  • iss — BKey issuer URL
Verify tokens using the JWKS endpoint.

​
Scopes

​
Next

  • Integrate BKey — the full endpoint surface, for integrators who don’t want to use our SDK
  • CLI Authentication — how humans log in, how agents get credentials
  • Client Credentials — agent grant details
  • CIBA — per-action biometric approval (with one-line SDK snippets)