Skip to main content
Bloom issues a dedicated API key for each partner integration. Keep the key on your server and never expose it in browser code, logs, source control, or agent prompts. Store it in your backend’s secret manager:

​
Send the key

Use x-api-key unless your HTTP client requires a bearer token:
Both headers authenticate the same key. Do not send both.

​
Base URL

All Brand Skill endpoints use the production base URL:
If a key may have been exposed, stop using it and contact Bloom for a replacement. See the API reference for the exact authentication and access errors.