GlymonirHTTP API documentation

Long-lived API keys and scope-bound endpoints for cron jobs, Workers, and external integrations.

Acts-as-user keys

Every key is bound to one user. Effective permissions = that user's account role ∩ the key's granted scopes — the same model as GitHub PATs and Stripe restricted keys.

Three least-privilege scopes

Grant only what a key needs — read (browse / search / download), write (upload + manage your own libraries), delete. Scopes are fixed once issued; to change them, mint a new key and revoke the old one.

Shown once, hashed at rest

The plaintext token is returned exactly once at creation — never logged, never stored. Lose it, revoke it, create a new one.

Rate-limited + an official CLI

Every key is rate-limited by its owner's plan (image bytes go through the CDN, uncounted). The official glymonir-cli wraps the whole upload flow — npx glymonir-cli upload *.jpg.

Quick example

Create a key in the web UI (Settings → API Keys) and pick the scopes you need (read / write). The plaintext gly_live_… is shown exactly once.

Call any endpoint with it as a Bearer token:

bash

# Search the public gallery (needs `read`)
curl "https://api.glymonir.com/api/gallery/search?q=cat&size=5" \
  -H "Authorization: Bearer gly_live_..."

To upload, use the official CLI — it runs the full local preprocess + two-stage R2 flow for you: