Get every new bloo.Cards entry in your systems.
The /v1 API and signed webhooks to wire your contacts, scans and forms into your tools. Your bloo.Cards key identifies your company and only allows reading your data. Reserved for Premium and Corporate company accounts, in early access. Hosted in the EU.
Outbound only · Premium and Corporate · hosted in the EU
Three secrets, three roles
| Secret | Role | Notes |
|---|---|---|
bc_live_… | bloo.Cards API key: identifies your company, read-only access to your bloo.Cards data | Created in the Developers section. Shown once, SHA-256 fingerprint stored, revocable. |
whsec_… | Webhook signing secret | Used to verify the webhook really comes from bloo.Cards (HMAC-SHA256). |
| CRM credentials | Stored encrypted, never re-shown | Per-organisation encryption (BlooCrypto). Used only for outbound sending to your CRM. |
The /v1 API Early access
Base: https://bloo.cards/v1 · Authentication: Authorization: Bearer bc_live_… header (never in the URL).
| Method | Role |
|---|---|
GET /v1/me | Company and scope of the key (connection test) |
GET /v1/contacts?since=… | New contacts since a moment (ISO 8601), with the revenue entered in blooCRM, the built-in mini CRM (deals_total, deals_count, last_deal_at) |
GET /v1/hooks | List of your webhook subscriptions |
POST /v1/hooks | Create a subscription { url, events[] } (returns the secret once) |
DELETE /v1/hooks/{id} | Disable a subscription |
Example: test the connection
curl -H "Authorization: Bearer bc_live_xxx" \
https://bloo.cards/v1/me
$ch = curl_init('https://bloo.cards/v1/me');
curl_setopt_array($ch, [
CURLOPT_HTTPHEADER => ['Authorization: Bearer bc_live_xxx'],
CURLOPT_RETURNTRANSFER => true,
]);
$me = json_decode(curl_exec($ch), true);
const r = await fetch('https://bloo.cards/v1/me', {
headers: { Authorization: 'Bearer bc_live_xxx' }
});
const me = await r.json();
import requests
r = requests.get(
'https://bloo.cards/v1/me',
headers={'Authorization': 'Bearer bc_live_xxx'})
me = r.json()
Webhooks Early access
Subscribe a URL to events; bloo.Cards sends a signed POST there on each occurrence, with retries on failure.
Events
contact.exchanged · lead.ocr_scanned · form.submitted · booking.requested · contact.deleted
Envelope received
POST https://votre-serveur.example/bloo-webhook
X-Bloo-Signature: t=1790456846,v1=9f2b…c3
{
"id": "evt_ab12cd34",
"type": "contact.exchanged",
"created_at": "2026-09-26T21:00:00Z",
"data": {
"contact": {
"first_name": "Marie", "last_name": "Dupont",
"email": "marie@exemple.be", "company": "Exemple SA",
"job_title": "Directrice", "source": "exchange",
"context": "Salon de Bruxelles"
}
}
}
Verify the signature (PHP)
$body = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_BLOO_SIGNATURE'] ?? ''; // t=…,v1=…
parse_str(strtr($header, ',', '&'), $p);
$expected = hash_hmac('sha256', $p['t'] . '.' . $body, $whsec);
if (!hash_equals($expected, $p['v1'] ?? '')) {
http_response_code(401); exit; // signature invalide
}
// OK : traitez $body (JSON)
Public card data
Public cards already expose their data as JSON-LD and via ?format=json, without authentication. Ideal for agents and indexing. An MCP server (Model Context Protocol) also lets AI assistants search public cards: https://bloo.cards/mcp. See bloo.Cards for AI.
Ready to wire in bloo.Cards?
With a Premium or Corporate company account, create your key in the Developers section of your account, or request early access. Step-by-step connection wizard · See the automations.
Create my API key