Skip to main content

​
Authentication

BKey is a standards-compliant OAuth 2.1 / OIDC / CIBA (RFC 8958) issuer. You can use BKey through our SDK (fastest) or talk to the standard endpoints directly from any OIDC-aware library. See Integrate BKey for the full integrator-facing tour of our endpoints — discovery, JWKS, CIBA, x402/MPP authorize, vault, checkout.

​
Grant Types

BKey supports three OAuth 2.1 grant types, each designed for a different use case.
GrantUse CaseWho
Client CredentialsServer-to-server, agent authenticationMachines
Device AuthorizationCLI login, IoT devicesHumans
CIBAPer-action biometric approvalHumans (triggered by agents)

​
Token Format

BKey issues JWTs signed with EdDSA (Ed25519). Tokens include:
  • sub — the user or client DID
  • scope — granted scopes
  • exp — expiration timestamp
  • iss — BKey issuer URL
Verify tokens using the JWKS endpoint.

​
Scopes

ScopeDescription
vault:accessRead vault items
vault:storeStore vault items
signing:createRequest document signing
signing:readRead signing status
identity:readRead user identity (UserInfo)
approve:actionApprove general actions (CIBA)
approve:paymentApprove payment actions (CIBA)
payment:authorizeAuthorize payments (x402 and MPP) on behalf of user
payment:addressRead user’s payment wallet address
payment:limitsManage per-agent spending limits

​
Next

  • Integrate BKey — the full endpoint surface, for integrators who don’t want to use our SDK
  • CLI Authentication — how humans log in, how agents get credentials
  • Client Credentials — agent grant details
  • CIBA — per-action biometric approval (with one-line SDK snippets)