An API token lets your own scripts and integrations use the Bloomlight API: a weekly report, a dashboard of your own, or a chart image in a status page. You choose which websites a token can reach and what it can do there, and you can revoke it at any time. To connect an AI agent instead, see Connect an AI agent to Bloomlight.
API tokens need a paid plan.
Create a token
Open API tokens
Choose Profile in your account menu, then API tokens. Choose New token.
Choose what it can do
Give it a name you'll recognise later, pick when it expires, tick what it may do and the websites it can reach. Websites you add to Bloomlight later aren't included.
Copy the token
The token is shown once, right after you create it. Store it somewhere safe, like a password manager. If you lose it, revoke it and create a new one.
What a token can do
- Read your websites: accounts, pages, findings, scores and charts. Every token can do this.
- Add notes and resolve findings: also restores findings. Resolving is a claim. The next audit confirms the finding if it's gone, or reopens it if it isn't.
- Ignore findings: hides a finding and stops it being audited again. You can restore an ignored finding at any time.
A token can never do more than you can. If you can only view a website, so can your token. Everything it changes shows in the website's activity as you via the token's name.
Use the token
Send the token in the Authorization header of every request. Each endpoint, and the scope it needs, is in the API docs.
curl -H "Authorization: Bearer YOUR_TOKEN" https://bloomlight.app/api/v1/websitesExpiry and revoking
A token lasts 30, 90 or 365 days, as you chose. It can't be renewed; when it expires, create a new one and swap it in. API tokens lists your tokens with the websites they reach, when they expire and when they were last used. Revoke stops a token straight away.