GlanceDocs

Authentication

The Glance API uses API keys for authentication. You can create and manage API keys from the Settings page in your Glance dashboard.

API Keys

API keys grant programmatic access to your Glance account. Each key is scoped to a specific company and user, inheriting the associated role's permissions (viewer, employee, editor, or owner).

A key looks like gk_live_ followed by 64 hexadecimal characters. It is shown in full only when it is created.

Security: Treat your API keys like passwords. Never expose them in client-side code, public repositories, or browser requests. Store them in environment variables or a secrets manager.

Making Authenticated Requests

Include your API key in the Authorization header as a Bearer token:

GET /clients HTTP/1.1
Host: api.glance.co.il
Authorization: Bearer gk_live_your_64_hex_character_key
Content-Type: application/json

Roles & Permissions

API keys inherit role-based access control. The role hierarchy from lowest to highest:

RoleDescriptionAccess Level
viewerRead-only accessCan view data but cannot create, edit, or delete
employeeBasic accessCan view and create most resources
editorFull operational accessCan view, create, edit, and delete resources
ownerFull administrative accessAll permissions including API key management and settings

Action Roles

Instead of (or on top of) a base role, a key can carry action roles: narrow grants for one action each, such as documents.create.invoiceReceipt. A key with only action roles can do exactly those things and nothing else, which is the safest setup for a third-party integration. Action roles are chosen when the key is created in Settings.

Action roleGrants
documents.viewGET /documents/id/:visibleId and GET /documents/by-external-id/:externalId, for reconciling what was issued.
clients.viewGET /clients, /clients/id/:visibleId, /clients/entity/:entityId and its addresses.
inventory.viewGET /inventory, /inventory/:id and /inventory/product/:productId.
webhooks.manageGET, POST and DELETE /webhooks (and the /grow/webhooks alias). Without it, managing webhooks needs an owner key.
E-commerce integrations: a store that issues documents for its orders needs these action roles and no base role: documents.create.invoiceReceipt, documents.create.invoice, documents.create.receipt, documents.create.refund, documents.view, clients.view, clients.create, products.view, inventory.view and webhooks.manage. Document previews (/documents/preview/*) use the same documents.create.* roles as creating.

Verifying a Key

GET /apiKeys/me tells an integration which key it holds: the company it belongs to, its base role and action roles, and its rate limit. It needs no particular role, so it works for a key that holds only action roles. Use it to check a key right after a user pastes it.

{
  "success": true,
  "data": {
    "key": {
      "id": 7,
      "name": "WooCommerce",
      "prefix": "gk_live_3f9a",
      "role": null,
      "actionRoles": [
        "documents.create.invoiceReceipt",
        "clients.view",
        "clients.create"
      ],
      "createdAt": "2026-10-19T09:12:00.000Z"
    },
    "company": {
      "id": 66,
      "name": "אלקבץ בע״מ",
      "taxId": "515000000"
    },
    "rateLimit": {
      "perMinute": 600
    }
  }
}

prefix is the first 12 characters of the key; the rest is never returned. role is null for a key with action roles only, and company.taxId is the business's registration number, or null. Called with anything other than an API key (a dashboard session), it answers 400 with code API_KEY_REQUIRED.

Authentication Errors

A missing, unknown or expired key gets a 401 Unauthorized with a WWW-Authenticate: Bearer header. A valid key that is not allowed to do something — its role, its company, a disabled module — gets a 403instead, so a 401 means “fix the key” and a 403 means “fix the permissions”:

{
  "success": false,
  "error": {
    "status": 401,
    "code": "UNAUTHORIZED",
    "message": "Unauthorized"
  }
}

One 401 has its own code: a key whose creator is no longer an active member of the company gets API_KEY_OWNER_INACTIVE. The key cannot be revived — a company owner has to create a new one. Show that to the user rather than asking them to re-enter the same key.

Last updated