generated: '2026-07-31'
method: searched
docs: https://help.boltapp.com/developers/tools/api-keys/
oauth_docs: https://help.boltapp.com/developers/bolt-oauth/
source: openapi/bolt-financial-bolt-api-openapi.yml, openapi/bolt-financial-embeddable-checkout-v1-openapi.yml,
  openapi/bolt-financial-embeddable-checkout-v3-openapi.yml
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
schemes:
- name: OAuth
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.boltapp.com/v1/oauth/authorize
    tokenUrl: https://api.boltapp.com/v1/oauth/token
    scopes: 3
  description: |-
    Bolt utilizes the OAuth flow that developers can use to attain access to Bolt Account data via APIs.
    For all APIs that require authorization, please provide your `access_token` returned from `/v1/oauth/token` via the basic auth bearer header `Authorization: bearer ${TOKEN}`.
    [Read more about the OAuth token endpoint.](/api-bolt/#tag/OAuth)
  sources:
  - openapi/bolt-financial-bolt-api-openapi.yml
  - openapi/bolt-financial-embeddable-checkout-v1-openapi.yml
  - openapi/bolt-financial-embeddable-checkout-v3-openapi.yml
- name: X-API-Key
  type: apiKey
  in: header
  parameter: X-API-Key
  description: Admins and Developers can obtain their Bolt API key from the Bolt Merchant Dashboard.
  sources:
  - openapi/bolt-financial-bolt-api-openapi.yml
  - openapi/bolt-financial-embeddable-checkout-v1-openapi.yml
  - openapi/bolt-financial-embeddable-checkout-v3-openapi.yml
credentials:
- name: API Key
  header: X-Api-Key
  purpose: Server-side calls from the merchant backend to the Bolt API.
  notes: Up to five active API keys per merchant; rotatable with no downtime from the Merchant
    Dashboard (Administration > API).
  source: https://help.boltapp.com/developers/tools/api-keys/
- name: Signing Secret
  header: X-Bolt-Hmac-Sha256
  rotation_header: X-Bolt-Hmac-Sha256-Pending
  purpose: HMAC-SHA256 signature verification of inbound Bolt webhooks and Merchant Callback
    requests.
  notes: Rotation supports an Active + Pending pair; reverting to the previous secret is possible
    for up to 48 hours.
  source: https://help.boltapp.com/developers/tools/api-keys/
- name: Publishable Key
  purpose: Client-side SDK initialization; also serves as the OAuth client_id.
  source: https://help.boltapp.com/developers/bolt-oauth/
required_headers:
- header: X-Api-Key
  value: the merchant API key
- header: X-Nonce
  value: unique 12-16 digit value per request (UUID recommended)
- header: Content-Type
  value: application/json
oauth:
  grant: authorization_code
  client_id: merchant publishable key
  client_secret: merchant API key
  authorization_code_ttl: 5 minutes
  access_token_ttl: 1 hour
  refresh_token_ttl: 1 year (single use)
  refresh_token_rotation: true
  token_presentation: 'Authorization: Bearer ${TOKEN}'
  oidc: true
  oidc_discovery: https://api.boltapp.com/.well-known/openid-configuration
  id_token_alg: RS256
  jwks_uri: https://api.boltapp.com/v1/oauth/jwks.json
  docs: https://help.boltapp.com/developers/bolt-oauth/