Server-to-Server (Auth Key)

Backend APIs for managing a block's end users, companies, roles and permissions without an end-user session.

Authenticate with the authkey header. Never expose an auth key in a browser or mobile app.

Typical flow: create users with Create Client User or Find or Create Users, mint a session with Get Auth Token, and manage access with the role and permission endpoints.

Many paths take {featureId} or {ref_id}. Both are the block's reference_id.

Where the authkey comes from

The authkey is provided by 36Blocks to the owner of the 36Blocks account. It is not created by any API endpoint or widget, so code and AI agents cannot fetch, generate or look it up. When a task needs it, the value comes from the user, who has it from 36Blocks.

Only the endpoints in this module use it. The widgets and the signed-in calls (/c/*) authenticate with the end user's proxy_auth_token and need no authkey.

GET

Server-to-Server (Auth Key)

Where the authkey comes from

List Roles (Server)

Create Role (Server)

Get Role (Server)

Update Role (Server)

Delete Role (Server)

List Permissions (Server)

Create Permission (Server)

List Client Users

Create Client User

Get Permission (Server)

Update Client User

Update Permission (Server)

Find or Create Users

Block, Unblock or Remove Client User

Delete Permission (Server)

List Companies of a Block

Update User Role in Company

Update User or Company Details

Bulk Update Roles

Get User or Company Details

Bulk Update Users

Check User Exists

Validate Creator Roles

Get Auth Token

Fix Missing Creator Roles

Get Onsite Auth Token

Validate Company Auth Key

Log Out All Users of a Block

Remove End User From Company

Delete Company

Login As End User

Get Companies of a User

Generate Session JWT

Build with 36Blocks User. Let AI do the rest.