Blend AI Documentation

Every request to the API needs an API key. Generate one from your API keys settings.

Bearer token

Send your API key in the Authorization header as a Bearer token:

Authorization: Bearer bai_your_key_here

API keys always start with the bai_ prefix. Any header missing the prefix or containing an invalid key returns a 401 authentication_error with sub-code invalid_api_key.

Treat API keys like passwords. Never commit them to source control or ship them in client-side code — use a server-side proxy if your frontend needs to call the API.

Billing ownership

When an API key calls a workflow:

The key owner is billed for the run (not the workflow author).
The workflow author may earn a revenue share on public/published workflows.
Runs are scoped to the key owner — you can only read back runs you started.

This means you can safely share published workflow IDs; callers spend their own credits to run them.

Rate limits

Rate limits are enforced per API key. Every response includes these headers:

Header	Meaning
`X-RateLimit-Limit`	Max requests in the current window.
`X-RateLimit-Remaining`	Requests left in the current window.
`X-RateLimit-Reset`	Unix epoch (milliseconds) when the window resets.
`Retry-After`	Only on 429. Seconds until retry is allowed.

If you exceed the limit, you’ll get:

HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1734567890000

{
    "error": {
        "message": "Rate limit exceeded. Try again later.",
        "type": "rate_limit_error",
        "code": "rate_limit_exceeded"
    }
}

Back off for at least Retry-After seconds before retrying.

CORS

The API sets Access-Control-Allow-Origin: *, so browser calls from any origin work. However, exposing your API key in browser code is never safe — always proxy through your own server.

Introduction

Endpoints

Authentication

Bearer token

Billing ownership

Rate limits

CORS

What’s next

Errors

Start a run

​Bearer token

​Billing ownership

​Rate limits

​CORS

​What’s next

Errors

Start a run

Bearer token

Billing ownership

Rate limits

CORS

What’s next