Authentication

Use an API key for server-side requests made on behalf of your account. Use OAuth when people connect their Rainbrand accounts to your product.

API keys

Generate a key in account settings and store it as RAINBRAND_API_KEY in your environment or secret manager. Keep it on the server and rotate it if exposed. Keys start with bloom_sk_.

curl https://www.rainbrand.com/api/v1/account \
  -H "x-api-key: $RAINBRAND_API_KEY"

You can also send the same key as a Bearer token:

curl https://www.rainbrand.com/api/v1/account \
  -H "Authorization: Bearer $RAINBRAND_API_KEY"

If both headers are present, x-api-key takes precedence.

OAuth

Send a Rainbrand OAuth access token as Authorization: Bearer, stored here as RAINBRAND_ACCESS_TOKEN:

curl https://www.rainbrand.com/api/v1/account \
  -H "Authorization: Bearer $RAINBRAND_ACCESS_TOKEN"

Tokens grant access to the connected user’s resources under the same ownership and plan checks as API keys. The scopes describe identity and refresh access:

Scope	Purpose
`openid`	Authenticate the user’s identity with OpenID Connect.
`offline_access`	Request a refresh token.

The authorization-server metadata publishes the current endpoints and supported scopes.

Register a public client

Use Authorization Code with PKCE S256. Public clients register without a client secret:

curl -X POST https://www.rainbrand.com/api/auth/oauth2/register \
  -H "Content-Type: application/json" \
  -d '{
    "token_endpoint_auth_method": "none",
    "type": "user-agent-based",
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "redirect_uris": ["https://acme.com/oauth/rainbrand/callback"]
  }'

Replace the callback with your product’s URL. Register and send the exact same redirect_uri during authorization; wildcards are not supported.

Getting started

Brands

Briefs

Generate

Reviews

Media

Account

Support

API keys

OAuth

Register a public client

​API keys

​OAuth

​Register a public client

API keys

OAuth

Register a public client