Skip to main content
All requests are made to the base URL https://www.useboom.ai and require an organization API key, sent as a Bearer token:
  • The key identifies your organization. You never pass an organization id: it’s derived from the key, and every request is scoped to it.
  • Keys are prefixed boom_org_ and are shown once at creation. Store the key securely; Boom only retains a hash.
  • Revoking a key in the dashboard immediately rejects further requests with 401.
Treat API keys like passwords. Never embed them in client-side code, mobile apps, or public repositories. Use server-to-server calls only.

​
Hosted environments

Boom exposes two hosted environments. Each has its own organizations and its own API keys. A production key is not valid against the development host, and vice versa. In the interactive API reference, switch the target with the server dropdown at the top of each endpoint. In your own code, set the base URL once (e.g. export BASE="https://dev.useboom.ai/api/v1/cdp") so you can point the same integration at either environment.
Not to be confused with the environments you create inside an organization to separate staging from production runs (see Webhooks). Those are a journey-level concept: they scope runs, webhook subscriptions, and credentials — not API keys. A key is scoped to its organization and works across all of that organization’s environments.

​
Errors

A 401 is returned with one of two messages depending on the failure mode:

Quickstart

Make your first authenticated calls end to end.

Rate limits & errors

Per-key limits, headers, and the shared error shape.

One uniform surface

The same capabilities over REST and MCP.