The API uses a bearer key. We create the key for you in our operations console and tie it to your customer account. We show it once. We store only a hash of it.

Send the key

Send it on every request in the Authorization header:

Authorization: Bearer hiero_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

A key looks like hiero_ followed by 32 letters, digits, dashes, or underscores.

Responses

401	The header is missing, the key is not known, or the key was revoked. The message is the same in each case.
403	The key is valid but not tied to a customer account. It can send inquiries and register webhooks but cannot create jobs, products, or orders.

Keep it safe

Store the key in a secret store or an environment variable. Do not put it in source control or in a browser.
Use one key for each system that calls us. If a key leaks, we revoke that one and issue a new one. Nothing else changes.
Keys do not expire. Ask us to revoke a key you no longer use.

What a key can do

Any key	Create and read inquiries.
Key tied to a customer	Also create jobs, attach files, read jobs, and accept estimates for that customer; and run on-demand selling: products, billing, orders.
Webhooks	Any key can register webhooks for its own events.
Auto-quote limit	Set by Glyph on the key. Jobs at or under it are invoiced the moment you accept. A new key starts at zero.

Get a key

Ask on the request form. Tell us the system that will call the API and what you make. A person at Glyph sets up the key and emails it to you, usually the same day.