Docs
Authentication
Every call to the API is authenticated with a key, and every key is scoped to what it is allowed to do.
The key
Made from a workspace's API page (Workspace → API), shown once at creation, and stored on Bloom's side only as a hash: nobody here can show it to you a second time, so losing it means rotating it rather than asking for it back. A key starts with blm_live_.
The header
As a Bearer token in Authorization, or in X-Api-Key if a Bearer header is awkward to set where you are calling from. Either is read the same way.
Authorization: Bearer blm_live_…
X-Api-Key: blm_live_…
A missing or unrecognised key answers 401. A revoked key is treated the same as one that never existed.
Scopes
A key can do only what it was given. A key baked into a downloadable build and meant to claim a licence on first run has no business reading whether somebody else's key is valid, so scopes are chosen when the key is made and checked on every request, not inferred from the key's name.
| Scope | What it allows |
|---|---|
| license.validate | Check whether a licence is valid The default scope on a new key. |
| license.issue | Claim a licence on first run |
| license.read | Look up a licence and its activations |
| license.manage | Suspend, renew and revoke licences Not reachable from the public API today; see Revoke. |
IP allowlist
A key can optionally be restricted to a list of IP addresses when it is made. Left empty, it works from anywhere. Set, a request from any other address is refused as if the key did not exist, same as a bad key: 401.
Rotating a key
One click on the workspace's API page replaces the secret on the same key. The name, scopes and request history stay attached to the same row; only the old secret stops working, immediately.