Docs
BetaThe V4 API is in beta — endpoints and functionality may change.

Developer apps

Build a Blooio App so your users can log in with Blooio and grant your integration scoped access to their organizations.

A Blooio App lets you build an integration that other Blooio users can install on their organizations. Instead of asking customers to paste an API key, they click Log in with Blooio, choose which organizations to install your app on, and approve the scopes you request. Your app then calls the same Blooio API endpoints an API key can — limited to the scopes the user granted.

Apps are owned by you (the developer), not by an organization. A single app can be installed on many organizations by many users.

Create an app

Create and manage apps in the Blooio dashboard. Each app has:

  • Name, description, homepage & logo — shown to users on the consent screen and in the marketplace.
  • Client type
  • Server-side (confidential) — has a client_secret. Use for backend services, server-rendered web apps, and CLIs.
  • Native / SPA (public) — no secret. PKCE is required on every authorization.
  • Redirect URIs — exact-match URLs Blooio will redirect back to after the user authorizes. Every character counts (trailing slash, port, query). https is required except for localhost/127.0.0.1.
  • Scopes — the permissions your app may request. Mark each as required (locked on at consent) or optional (default-checked, user can uncheck).
  • Visibility
  • Private — installable only on organizations the installing user belongs to.
  • Public — listed in the marketplace after review and approval.

When you create a confidential app, the client_secret is shown once. Store it securely; if you lose it, regenerate a new one (which immediately invalidates the old one).

Credentials

Every app has a client_id (looks like bloapp_...). Confidential apps also have a client_secret (looks like blosec_...). You'll use these in the authorization flow.

Updating an app

You can edit an app at any time. If you change the scopes of a published app, each organization must re-accept the new permissions before the new scopes take effect — existing tokens keep only their previously granted scopes.

Next steps