Authentication

Every request to https://api.glexir.com/v1 needs a Glexir API key. You send it as a bearer token in the Authorization header. Keys belong to your organization and start with glx_live_.

import Glexir from "@glexir/sdk";

// Reads GLEXIR_API_KEY from the environment when apiKey is not passed.
const glexir = new Glexir();

for await (const model of glexir.models.list()) {
  console.log(model.id);
}

API keys

Create keys on the API keys page of the dashboard. A key looks like glx_live_ followed by 40 letters and digits.

• The full key is shown once, when you create it. Glexir stores only a hash, so it cannot show the key again. If you lose it, create a new one.
• The dashboard lists each key by name and a short form such as glx_live_AbCd…wxyz (the first 13 characters and the last 4), with its spend this month and when it was last used.
• A name is optional and can be up to 80 characters. A blank name becomes "Secret key".
• Every key has full access to your organization's API resources. Restricted and read-only keys are not available yet.
• You can rename a key, change its monthly limit or revoke it. Revoking cannot be undone. A revoked key can keep working for up to 30 seconds, because the gateway caches key lookups for that long.

Rotate a key

1. Create a new key.
2. Deploy it to your servers in place of the old one.
3. Check on the Usage page, grouped by API key, that the old key has stopped receiving traffic.
4. Revoke the old key.

The Authorization header

Authorization: Bearer glx_live_...

The header must start with Bearer (capital B, one space). Any other scheme is treated as a missing key. Requests without a valid key get 401:

{
  "error": {
    "message": "Invalid or missing API key.",
    "type": "authentication_error",
    "param": null,
    "code": "invalid_api_key"
  }
}

In the SDK this is an AuthenticationError. It is not retried.

import Glexir, { AuthenticationError } from "@glexir/sdk";

const glexir = new Glexir();

try {
  await glexir.models.list();
} catch (err) {
  if (err instanceof AuthenticationError) {
    console.error("Check GLEXIR_API_KEY:", err.code, err.requestID);
  } else {
    throw err;
  }
}

Any OpenAI-compatible client works the same way: give it the Glexir key as its API key and https://api.glexir.com/v1 as its base URL. See Use any OpenAI SDK.

Keys in the SDK

The client takes the key from the apiKey option. If you don't pass it, it reads GLEXIR_API_KEY. Whitespace around the value is trimmed, and an empty value counts as unset.

import Glexir from "@glexir/sdk";

const glexir = new Glexir({ apiKey: process.env.GLEXIR_API_KEY });

If there is no key, the constructor throws a GlexirError before any request is sent:

Missing API key. Pass `new Glexir({ apiKey })` or set the GLEXIR_API_KEY environment variable.

The SDK reads these from process.env. In runtimes without process.env, such as Cloudflare Workers or Deno without Node compatibility, pass apiKey (and baseURL, if you need a non-default one) yourself, for example from your Worker's bindings.

Each client holds one key. To call Glexir with two keys, create two clients. The SDK sets the Authorization header itself, but a header with the same name in defaultHeaders or in a method's request options replaces it, so don't put authorization there unless you mean to.

Other client options (timeout, maxRetries, fetch) are covered in Client configuration.

Keep keys on your server

An API key spends your organization's credit. Never put one in browser code, a mobile app or a public repository. Anyone who can see the key can use it.

@glexir/sdk runs in browsers, but that doesn't make it safe to call Glexir from one. Call Glexir from your backend and expose only the endpoint your app needs:

import Glexir from "@glexir/sdk";

const glexir = new Glexir({ apiKey: process.env.GLEXIR_API_KEY });

// A server route, e.g. POST /api/summarize. The browser never sees the key.
export async function POST(request: Request): Promise<Response> {
  const { text, userId } = (await request.json()) as { text: string; userId: string };
  const response = await glexir.responses.create({
    model: "gpt-6-luna",
    instructions: "Summarize the text in two sentences.",
    input: text,
    safety_identifier: userId,
  });
  return Response.json({ summary: response.output_text });
}

If a key leaks, revoke it on the API keys page and create a new one.

Per-key monthly limits

Each key can have its own monthly spend limit in USD. Set it when you create the key or later from Edit. Leave it blank for no limit.

• The month is the calendar month in UTC. The key's spend resets on the 1st.
• Before a request runs, Glexir reserves an estimate of its cost. The request is rejected if the key's spend this month, plus what its in-flight requests have reserved, plus this estimate would go over the limit.
• A rejected request returns 402, type insufficient_quota, code spend_limit_exceeded and param "api_key". Nothing is charged.

{
  "error": {
    "message": "This request would exceed the API key's monthly limit of $50.00.",
    "type": "insufficient_quota",
    "param": "api_key",
    "code": "spend_limit_exceeded"
  }
}

The SDK has no subclass for 402, so this is a plain APIError with status === 402. Check err.code.

Other limits apply to the whole organization, across all its keys: the organization's monthly limit (same 402 and code, with param "organization"), requests per minute and concurrent requests (both 429). See Rate limits & spend limits.

Organization isolation

A key acts for the organization that created it. All keys in an organization share its credit balance, limits and stored objects. Nothing is shared between organizations:

• Stored objects belong to the organization that created them: responses, conversations, files, batches and stored chat completions. Lists return only your own objects. An ID that belongs to another organization returns 404, as if it did not exist.
• Prompt caching is scoped to your organization. Glexir prefixes prompt_cache_key with a value derived from your organization, so cached prompts are never shared with another customer. You can still set your own prompt_cache_key to group requests within your organization.
• To tell your end users apart, send a stable ID per user in safety_identifier (or the older user field). Glexir replaces it with a hashed ID derived from your organization and that value before the request reaches OpenAI, so abuse by one of your users is attributed to that user and is not linked to other customers. On /embeddings, Glexir uses the user field for this.
• On stored chat completions (store: true), Glexir adds its own metadata key to record the owner and removes it from every response. This leaves you 15 metadata keys instead of 16.

If your organization is suspended, every request that would be billed returns 403 with code account_suspended.