> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rainbrand.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Rainbrand API.

Every request to the Rainbrand API needs either a Rainbrand API key or a Rainbrand OAuth access token. API keys are simplest for server-side automations. OAuth is the right fit for app integrations where a user signs in with Rainbrand and grants access.

## API keys

Generate an API key from your [account settings](https://www.rainbrand.com/account?tab=api-keys) and treat it as a secret — rotate any that may have been exposed. Keys start with `bloom_sk_`, the prefix from Rainbrand's former name.

You can send the key in either of two headers; both accept the same key. If both headers are present, `x-api-key` wins.

### `x-api-key` header

```http theme={"dark"}
x-api-key: bloom_sk_...
```

### `Authorization: Bearer` header

```http theme={"dark"}
Authorization: Bearer bloom_sk_...
```

Use whichever fits your client. `x-api-key` is the most direct; `Authorization: Bearer` is useful when you're working with HTTP libraries that expect that shape (most SDKs, many low-code tools).

## OAuth access tokens

The REST API also accepts Rainbrand OAuth access tokens:

```http theme={"dark"}
Authorization: Bearer <rainbrand_oauth_access_token>
```

OAuth tokens resolve to the same user identity as an API key. They have the same access to brands, images, credits, plan gates, and workspaces.

Rainbrand's OAuth endpoints are:

```text theme={"dark"}
Issuer: https://www.rainbrand.com/api/auth
Dynamic client registration: https://www.rainbrand.com/api/auth/oauth2/register
Authorize: https://www.rainbrand.com/api/auth/oauth2/authorize
Token: https://www.rainbrand.com/api/auth/oauth2/token
API base: https://www.rainbrand.com/api/v1
```

Public clients should use Authorization Code with PKCE S256 and dynamic client registration:

```json theme={"dark"}
{
  "token_endpoint_auth_method": "none",
  "type": "user-agent-based",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "redirect_uris": ["https://your-app.example/oauth/callback"]
}
```

For app integrations with public clients, do not use a `client_secret`. Register the exact callback URL for the current deploy and send that exact `redirect_uri` in the authorize request; wildcard redirect URIs are not supported.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.