Authentication

How to authenticate, what a key may do, and the limits a key is held to.

Every request needs an Authorization: Bearer bloomcount_… header. Keys are created from Settings → API in the app and are scoped: a key without products:write cannot create products, and so on.

Rate limits and quotas

• Per key: 60 requests per minute.
• Per tenant, per month: set by the plan’s apiLimit entitlement.

Exceeding either returns 429. Live usage is shown on the API settings page.

Idempotency

Every POST endpoint honours Idempotency-Key. Replays return the cached response verbatim, for 24 hours, scoped per key. Retrying a failed request therefore never double-creates data.