Getting Started
Authentication
BLAZLE uses API keys for programmatic access and JWT-based sessions for the dashboard.
API Key Authentication
All requests to /api/v1/intercept/* must include your API key as a Bearer token:
Authorization: Bearer blz_live_your_api_key
Keys are prefixed blz_live_. Never expose them in client-side code or public repositories. Revoke compromised keys immediately from the dashboard.
Webhook Signing Secrets
Outbound event webhooks generated by BLAZLE include an HMAC-SHA256 signature payload using your organization's webhook secret:
blz_whsec_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d
Signing secrets use the blz_whsec_ prefix. Verify incoming webhook signatures against raw request body bytes to guarantee message authenticity.
Dashboard Sessions (JWT)
The BLAZLE dashboard uses short-lived JWT access tokens (24h expiry) stored in HttpOnly, Secure, SameSite=Strict cookies — inaccessible to JavaScript. Sessions are managed automatically by the browser.
OAuth Login
You can sign in with GitHub or Google:
GET /api/v1/auth/github/login → Redirects to GitHub OAuth GET /api/v1/auth/google/login → Redirects to Google OAuth
Enterprise SSO & SCIM 2.0
For Enterprise plans, BLAZLE supports OpenID Connect (Okta, Azure AD) and automated user provisioning via SCIM 2.0.
Administrators can generate a permanent SCIM Bearer token from the Dashboard > SSO & SCIM tab and point their Identity Provider to the /scim/v2 base URL for automated user creation, updates, and deprovisioning.