Skip to main content
Glade API authenticates every request with an API key. You generate a reveal-once key from the dashboard and include it in one of the supported headers on each call. There are no session tokens, OAuth flows, or cookies — every request is independently authenticated, making Glade API straightforward to use from scripts, server-side code, and AI agents alike.

​
Creating an API key

1

Sign in to the dashboard

Go to gladeapi.com/auth/login and sign in to your account. If you do not have an account yet, sign up for free — no credit card required.
2

Navigate to API Keys

From the dashboard sidebar, click API Keys. You will see a list of any existing keys along with their creation date and last-used timestamp.
3

Create a new key

Click New key, optionally give it a descriptive label (for example, production-price-monitor), and confirm. Your new key is displayed one time only — copy it immediately before closing the dialog.
4

Store the key securely

Paste the key into an environment variable, a .env file that is excluded from version control, or your team’s secrets manager (for example, AWS Secrets Manager, HashiCorp Vault, or GitHub Actions secrets). Never hard-code it in source files.
Your API key is revealed only once at creation time. If you lose it, you cannot recover it — generate a new key from the dashboard and revoke the old one.

​
Passing your key

Glade API accepts your key in three header formats. Use whichever format is most convenient for your stack; all three are equivalent in terms of authentication and billing. 1. API-KEY header (recommended) The simplest and most explicit option. Add an API-KEY header to every request:
2. Bearer token (Authorization header) If your HTTP client or framework uses the standard Bearer token pattern, pass your key as the token value:
3. MCP-specific headers When connecting via the MCP interface, two additional header names are also accepted alongside API-KEY and Authorization: Bearer:
Conflicting credentials — for example, sending both an API-KEY header and an Authorization header with different key values in the same request — are rejected with a 400 Bad Request error. Always pass a single key in a single header per request.

​
Authentication errors

When authentication fails, Glade API returns a JSON error envelope with a success: false flag and a structured errors array:
The HTTP status code in the response tells you the category of the problem: Calls that return any of these errors are never charged — you only consume units on successful responses.

​
Keeping keys secure

Follow these best practices to keep your API keys safe:
  • Use environment variables. Load your key from the environment rather than hard-coding it in source files.
  • Never commit keys to version control. Add .env to your .gitignore and audit your repository history if you suspect a key was accidentally committed.
  • Rotate keys if exposed. If a key is leaked, revoke it from the dashboard immediately and generate a replacement — existing code only needs a one-line environment variable update.
  • Use separate keys per environment. Create distinct keys for development, staging, and production so you can revoke one without affecting the others.
  • Set descriptive labels. Name each key after its purpose (e.g., ci-tests, prod-price-monitor) so you can identify and revoke the right one quickly.
Set your key as an environment variable so you can reference it consistently across scripts:
Then use $GLADE_API_KEY in any script or command without exposing the raw value:
In application code, read the key from the environment at startup rather than at call time to catch misconfiguration early: