Developers

Get every new bloo.Cards entry in your systems.

A read-only API and signed webhooks to wire your contacts, scans and forms into your tools. Simple, safe, hosted in the EU.

Outbound only · read-only · hosted in the EU

Three secrets, three roles

Secret	Role	Notes
`bc_live_…`	API key: identifies your company, read-only	Created in the Developers section. Shown once, SHA-256 fingerprint stored, revocable.
`whsec_…`	Webhook signing secret	Used to verify the webhook really comes from bloo.Cards (HMAC-SHA256).
CRM credentials	Stored encrypted, never re-shown	Per-organisation encryption (BlooCrypto). Used only for outbound sending to your CRM.

The `/v1` API Early access

Base: https://bloo.cards/v1 · Authentication: Authorization: Bearer bc_live_… header (never in the URL).

Method	Role
`GET /v1/me`	Company and scope of the key (connection test)
`GET /v1/contacts?since=…`	New contacts since a moment (ISO 8601)
`GET /v1/hooks`	List of your webhook subscriptions
`POST /v1/hooks`	Create a subscription `{ url, events[] }` (returns the secret once)
`DELETE /v1/hooks/{id}`	Disable a subscription

Example — test the connection

curl -H "Authorization: Bearer bc_live_xxx" \
     https://bloo.cards/v1/me

$ch = curl_init('https://bloo.cards/v1/me');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER    => ['Authorization: Bearer bc_live_xxx'],
  CURLOPT_RETURNTRANSFER => true,
]);
$me = json_decode(curl_exec($ch), true);

const r = await fetch('https://bloo.cards/v1/me', {
  headers: { Authorization: 'Bearer bc_live_xxx' }
});
const me = await r.json();

import requests
r = requests.get(
    'https://bloo.cards/v1/me',
    headers={'Authorization': 'Bearer bc_live_xxx'})
me = r.json()

Webhooks Early access

Subscribe a URL to events; bloo.Cards sends a signed POST there on each occurrence, with retries on failure.

Events

contact.exchanged · lead.ocr_scanned · form.submitted · booking.requested · contact.deleted

Envelope received

POST https://votre-serveur.example/bloo-webhook
X-Bloo-Signature: t=1790456846,v1=9f2b…c3

{
  "id": "evt_ab12cd34",
  "type": "contact.exchanged",
  "created_at": "2026-09-26T21:00:00Z",
  "data": {
    "contact": {
      "first_name": "Marie", "last_name": "Dupont",
      "email": "marie@exemple.be", "company": "Exemple SA",
      "job_title": "Directrice", "source": "exchange",
      "context": "Salon de Bruxelles"
    }
  }
}

Verify the signature (PHP)

$body   = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_BLOO_SIGNATURE'] ?? '';   // t=…,v1=…
parse_str(strtr($header, ',', '&'), $p);
$expected = hash_hmac('sha256', $p['t'] . '.' . $body, $whsec);
if (!hash_equals($expected, $p['v1'] ?? '')) {
    http_response_code(401); exit;                    // signature invalide
}
// OK : traitez $body (JSON)

Public card data

Public cards already expose their data as JSON-LD and via ?format=json, without authentication. Ideal for agents and indexing. See bloo.Cards for AI.

Ready to wire in bloo.Cards?

Create your key in the Developers section of your account, or request early access. See the automations.

Create my API key