Authentication

For authentication, we use Microsoft Entra ID (formerly Azure Active Directory). This ensures secure identity management and token-based access control for all API interactions.

When you become a customer, we register your system(s) in our identity platform. This registration enables your systems to request access tokens, which are required to authenticate and interact with our API securely.

We support multi-system configurations, allowing you to register multiple systems under your account. This setup enables you to scope access to specific areas of the API for each system individually, ensuring fine-grained control and separation of concerns.

Authorization

All requests made to the API must include a valid access token in the Authorization header. Without this token, requests will be rejected.

Once a system is registered, it can obtain access tokens via Microsoft Entra. These tokens are scoped to the permissions granted during registration and will authorize access only to the relevant parts of the API.

When you sign up for the Bloom Charge CPMS, we will automatically generate a dedicated API endpoint for your organization. This endpoint serves as your entry point to interact with the platform and ensures that your data and operations are isolated and secure.