API Reference

Authentication

Every request needs an API key with the content.read scope. Create keys in Settings → Space → Developers.

Authorization header

The recommended way to authenticate. Send the key as a Bearer token:

curl 'https://glu.so/api/v1/public/content/posts' \
  -H 'Authorization: Bearer YOUR_API_KEY'

Query parameter

For quick tests or contexts where you can't set headers, pass the key as ?api_token=:

curl 'https://glu.so/api/v1/public/content/posts?api_token=YOUR_API_KEY'

Prefer the header in production — query strings can end up in server logs and browser history.

Scoping & expiry

  • Keys are bound to a space — the key alone determines whose content you read. No cookie or session is involved.
  • Keys need the content.read scope; without it requests return 403.
  • Keys can carry an expiry date; expired keys return 401.

See Errors for the full status-code reference.