Skip to main content

Authentication Overview

Glean's three REST API families use different authentication models. Start by choosing the API family you need, then choose the access model that fits your integration. Follow that API's implementation guide for the exact credential and scope requirements.

Finding Your Server URL​

All Glean API requests require your organization's server URL. Find it in the Server instance (QE) field on the Glean About page.

Your server URL is used in API requests and API client configuration:

  • Platform API: https://<your-server-url>/api/...
  • Client API: https://<your-server-url>/rest/api/v1/...
  • Indexing API: https://<your-server-url>/api/index/v1/...

API authentication at a glance​

Platform API

Supported APIs:Platform API

Recommended for new integrations

  • OAuth is preferred for per-user integrations
  • Glean OAuth Authorization Server (on by default; some IdP OAuth tenants keep it off) or external IdP OAuth
  • Glean-issued tokens for Indexing, global X-Glean-ActAs, or when no OAuth path exists
  • Platform authentication guide

Client API

Supported APIs:Client API

For existing and specialized user-facing integrations

  • OAuth is preferred for per-user integrations
  • Glean OAuth Authorization Server (on by default; some IdP OAuth tenants keep it off) or external IdP OAuth
  • Glean-issued tokens for global X-Glean-ActAs, or when no OAuth path exists
  • Client authentication guide

Indexing API

Supported APIs:Indexing API

For content ingestion and management

Choose an authentication path​

Platform API: per-user or admin-managed access​

For per-user Platform API integrations, prefer OAuth. The Glean OAuth Authorization Server is on by default. Tenants that already used IdP OAuth may have it off. Use an external-IdP OAuth token when your organization already issues those tokens. Use a Glean-issued token for global permissions with X-Glean-ActAs, or when no OAuth path exists. See the Platform API authentication guide.

Client API: per-user or admin-managed access​

For per-user Client API integrations, prefer OAuth. The Glean OAuth Authorization Server is on by default. Tenants that already used IdP OAuth may have it off. Use external-IdP OAuth when your organization already issues the access tokens. Use a Glean-issued token for global permissions with X-Glean-ActAs, or when no OAuth path exists. See the Client API authentication guide.

Indexing API​

The Indexing API requires Glean-issued tokens. OAuth is not supported for ordinary Indexing API operations. See the Indexing API authentication guide.

Try a request in your tenant​

Use the Search API Explorer to test Client API authentication against your own Glean tenant. For Platform or Indexing API authentication, use that API's getting-started guide. API Explorer is for interactive tenant testing. It is not production sample code, and it does not replace your application's OAuth flow.

Shared security practices​

  • Store credentials securely and never commit them to source control.
  • Use environment variables or a secrets manager for application credentials.
  • Use the least-privileged credential and scopes available for your integration.
  • Rotate long-lived credentials and plan for expiry before production rollout.
  • Handle 401, 403, and rate-limit responses explicitly.

Next steps​

  1. Choose the right API from the Glean API overview.
  2. Follow the API-specific authentication guide above.
  3. Try the API's getting-started example before building the complete integration.