API essentials

Everything in Glemo is one HTTPS API described by an OpenAPI spec. This page covers what every integration needs; the interactive reference documents every endpoint.

Authentication

Send your API key as a Bearer token:

curl https://api.glemo.io/verify \
  -H "Authorization: Bearer glemo_live_…"

Keys belong to a relying party and carry scopes (e.g. verify:read). Manage them, create, rotate, revoke, from your dashboard or the /relying-parties/{id}/keys endpoints.

Secrets are shown once

A key's secret is returned only at creation or rotation. Store it in a secret manager; if you lose it, rotate.

Test vs live

Prefix	Environment	Use
`glemo_test_…`	Sandbox	Development, CI, the docs try-it
`glemo_live_…`	Production	Real verifications

Sandbox keys come from the self-serve provisioner (POST /sandbox/keys, see the quickstart) and only carry verify:read.

For browser surfaces (the <glemo-verify> widget), use a key whose only scope is verify:read. It can read verdicts and nothing else, so it's safe to ship in client code. Never embed a key with management scopes.

Errors

Errors are JSON with a stable error code. The SDK maps them to typed exceptions:

HTTP	`error`	SDK error	What to do
401	`unauthorized`	`AuthenticationError`	Check the key / rotate
403	`forbidden`	`PermissionError`	Key lacks the scope
422	`validation`	`ValidationError`	Fix the request body
429	`rate_limited`	`RateLimitError` (`retryAfter`)	Back off, then retry
5xx	,	`ApiError`	Retry with backoff

{ "error": "rate_limited", "message": "Too many requests" }

Rate limits

Limits are per key (or per IP on public endpoints). When throttled you get a 429 with a Retry-After header in seconds. The SDK retries network and 5xx failures once by default; it never retries 4xx.

Idempotency & latency

Verification is a read: calling /verify twice is safe by design. Verdict computation takes tens of milliseconds server-side (p50 ~40ms in our load test); the rest of what you observe is network. Every response carries its measured latencyMs, and every verification is logged to your dashboard with its verdict and latency.