generated: '2026-07-18'
method: searched
source: https://docs.b3.fun/sdk/global-account/authentication
docs: https://docs.b3.fun/sdk/api-key-request
note: >-
  The B3OS Workflow OpenAPI declares no securitySchemes, so the mechanical
  derive produced nothing; this profile is captured from the B3 developer docs.
  B3 exposes three distinct authentication surfaces across its products.
summary:
  types: [apiKey, custom]
  api_key_in: [header]
surfaces:
  - name: B3OS Workflow API
    api: openapi/b3-b3os-workflow-openapi.json
    scheme: api-key
    detail: >-
      API-key auth. The API exposes an api-keys resource (create/list/revoke) and
      per-organization webhook secrets. Request a key via docs.b3.fun/sdk/api-key-request.
    docs: https://docs.b3.fun/sdk/api-key-request
  - name: B3 Data API
    scheme: none
    detail: >-
      Public, no authentication required. Blockscout + Thirdweb Insights indexed
      data is served free with no key for public endpoints.
    docs: https://docs.b3.fun/data/api-reference/introduction
  - name: B3 Global Accounts (SDK)
    scheme: global-accounts
    detail: >-
      End-user authentication via B3 Global Accounts — social login (Google,
      Discord), headless auth service, session keys and scoped permissions.
      Consumed client-side through @b3dotfun/sdk (useB3 / useAccountWallet hooks).
    docs: https://docs.b3.fun/sdk/global-account/authentication
schemes:
  - name: clientId
    type: apiKey
    in: header
    parameter: x-client-id
    description: thirdweb client ID in headers (Insights passthrough)
    sources: [openapi/b3-data-api-openapi.json]
  - name: secretKey
    type: apiKey
    in: header
    parameter: x-secret-key
    description: thirdweb secret key in headers
    sources: [openapi/b3-data-api-openapi.json]
  - name: dashboard
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: thirdweb JWT + Client ID
    sources: [openapi/b3-data-api-openapi.json]
  - name: clientId-query
    type: apiKey
    in: query
    parameter: clientId
    description: thirdweb client ID in query params
    sources: [openapi/b3-data-api-openapi.json]
updated: '2026-07-22'
update_note: >-
  Round 2 harvested the B3 Data API OpenAPI (https://data-api.b3.fun/swagger.json),
  which declares four securitySchemes for Thirdweb Insights passthrough; public
  Blockscout endpoints remain unauthenticated. Added as schemes[] above.