Partner API

Build your front end with Blast’s read API. Keep your existing partner credential on your backend and send it with each request.

Setting	Value
Base URL	https://www.blast.fun
Authentication header	X-Blast-Partner-Key
Read methods	GET, HEAD
Shared partner quota	300 requests/minute, 50,000 requests/UTC day

Explore the interactive API reference → · Download OpenAPI · Rate limits and errors

Available now · More coming soon

Presale lists, featured presales, presale details, price history, search, and market status are live. Search has partial coverage: profiles are unavailable and launchpad coins are not indexed.

Coming soon: discovery, holder snapshots, launch activity, curve pool summaries, pool candles, and venue trades. You can already read their schemas, parameters, and examples in the reference. Live calls return 503 until launchpad indexing is enabled; replacing your key or retrying will not change that.

A valid key authorizes API reads independently of the private frontend. It does not unlock the website, account data, transaction signing, writes, or WebSockets.

First request

Store the key as the private environment variable BLAST_PARTNER_KEY. Do not put it in a URL, a public environment variable, source control, or request logs.

curl --fail-with-body \
  'https://www.blast.fun/api/v1/presales?status=live&limit=20' \
  -H "X-Blast-Partner-Key: $BLAST_PARTNER_KEY"

A successful response contains presales, next_cursor, and as_of. Pass a non-null next_cursor back as cursor to read another page, keeping the status, sort, and filters unchanged. A null cursor means the final page. See the endpoint reference for parameters and sorting options.

TypeScript SDK

Install the published REST client in your server application:

npm install @interest-protocol/blast-partner-client@0.1.0

The MIT-licensed package has no runtime or peer dependencies. It is separate from the on-chain @interest-protocol/blast-sdk; that package’s ./partners export represents on-chain contracts.

Configure BLAST_PARTNER_KEY in your server’s secret store or private environment. The SDK uses your existing credential; it does not create or distribute credentials. Never use a public environment variable or include the key in a browser bundle.

This TypeScript example is a server handler using Node.js environment access and standard Request/Response APIs. Mount it behind your application’s authentication and rate limits. Your browser calls this handler; the SDK sends X-Blast-Partner-Key to https://www.blast.fun/api/v1.

import {
  BlastPartnerError,
  createBlastPartnerClient,
} from "@interest-protocol/blast-partner-client";

const partnerKey = process.env.BLAST_PARTNER_KEY;
if (!partnerKey) {
  throw new Error("Configure BLAST_PARTNER_KEY on the server.");
}

const blast = createBlastPartnerClient({ partnerKey });

export async function listPartnerPresales(request: Request): Promise<Response> {
  try {
    const page = await blast.listPresales(
      { status: "live", limit: 20 },
      { signal: request.signal },
    );

    return Response.json(page, {
      headers: { "Cache-Control": "private, no-store" },
    });
  } catch (error) {
    if (!(error instanceof BlastPartnerError)) {
      throw error;
    }

    return Response.json(
      { error: { code: error.code ?? error.kind } },
      {
        status: error.status === 429 ? 429 : 502,
        headers: {
          "Cache-Control": "private, no-store",
          ...(error.retryAfter ? { "Retry-After": error.retryAfter } : {}),
        },
      },
    );
  }
}

The response retains presales, next_cursor, as_of, exact amount/price strings, and null values. Each call fetches one page; pass a non-null next_cursor as cursor with the same filters for the next page. See pagination and data handling.

The six live methods are listPresales, featuredPresales, presale, prices, search, and marketStatus. Coming-soon launchpad operations have no client methods. Search retains its partial coverage and section availability states.

The core is environment agnostic and uses standard Fetch, Streams, URL, TextDecoder, and AbortController APIs. Environment access in this example belongs to your application; other server runtimes should load the secret through their own bindings and can inject a compatible fetch via createBlastPartnerClient({ partnerKey, fetch }). Node and Bun have been tested; Deno and edge runtimes have not been directly verified.

Requests default to a 10-second timeout and a 2 MiB decoded response limit. The SDK performs no automatic retries, polling, or caching. BlastPartnerError exposes sanitized kind, status, code, and retryAfter fields. Never log credentials, request headers, or raw transport errors. Do not retry 401/403; handle 429 and temporary 503 responses with bounded backoff and Retry-After as described in retry behavior.

The key is the complete value issued by Blast, including its blast_pk_ prefix. Use X-Blast-Partner-Key, not Authorization: Bearer or X-Blast-Api-Key. You do not need a Blast login, wallet signature, or page cookie. An invalid supplied key is rejected even if other credentials are present.

Server integration

Keep the keyed SDK client in a server module. Protect your proxy with your application’s own authorization and quotas, accept only the inputs your application needs, and return Cache-Control: private, no-store. Do not expose arbitrary upstream URL or header forwarding. Use the public partner API at https://www.blast.fun/api/v1; the internal service at https://api.blast.fun uses unrelated credentials.

The REST API also supports CORS for exact HTTPS origins registered by Blast. CORS does not hide a key or prevent its use outside a browser. Use your server/proxy for application integrations so the partner credential stays out of public browser code. See the authentication and origin errors when troubleshooting an existing direct-browser integration.

Rotation and leaked keys

Contact Blast immediately if a key leaks. Blast can revoke that individual key without redeploying. Once revocation succeeds, subsequent authentication checks reject it with 401 partner_key_invalid; an already authorized request can finish.

For routine rotation, request a replacement for the same partner, switch your backend to it, and then ask Blast to revoke the old key. For a known leak, revoke the compromised key immediately. Keys are shown only once when issued; a lost secret must be replaced. Rotation does not reset quotas, and revoking one key does not revoke your other keys.

Reading responses

• Success responses are JSON; HEAD has no response body and uses the same quota as GET.
• Keep field names as returned: some endpoints use next_cursor, others nextCursor. Pagination tokens are opaque and belong to their original resource and filters.
• Amounts and prices returned as decimal strings must retain their precision. Use BigInt for integer atomic amounts and a decimal library for decimal prices. Timestamps ending in _ms or Ms are Unix milliseconds; durations such as lag_ms are milliseconds; basis points use 10,000 for 100%.
• Freshness is reported in as_of, provenance, or a section’s provenance. Null or unavailable data is not zero. Handle missing prices, incomplete holder snapshots, and stale data explicitly.
• Partner HTTP responses use no-store. Do not assume shared CDN caching or successful responses on every request. See retry behavior.

Continue with the read endpoint reference.

API version

Use /api/v1 for new integrations. Existing /api/social/... and /api/launchpad/... partner URLs continue working with the same keys; no immediate migration is required. See the versioning and compatibility policy.