Skip to main content

Authentication

Every request carries an API key in the X-API-Key header.

curl -H "X-API-Key: mgi_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
     https://your-server/api/v1/integration/connection

Getting a key​

Keys are generated inside Mover.Glass, under your integrator registration. Ask whoever administers your installation.

Two things to know before you ask:

The key is shown once. We store only a hash of it, so we cannot recover it later — if it is lost, the only option is to revoke it and generate a new one. Copy it straight into wherever it will live.

Use one key per installation. Not one per company. If a machine is compromised or decommissioned, that key is revoked without disturbing anyone else. Each key has a name, so the list stays readable a year from now.

GET /api/v1/integration/connection​

Checking that it works.

Before anything else, confirm the URL and the key:

curl -H "X-API-Key: mgi_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
     https://your-server/api/v1/integration/connection
{
  "connected": true,
  "authenticatedByApiKey": true,
  "apiKeyId": 12,
  "email": "integrator@customer.com",
  "serverUtc": "2026-09-18T14:02:11Z"
}

This is worth wiring into your own monitoring. It answers three questions at once: the server is reachable, the key is valid, and the clocks agree. Most integration problems that look mysterious are one of those three.

apiKeyId tells you which key authenticated. When several installations share a server, that number is how you tell them apart in a support conversation.

When a key stops working​

A revoked or invalid key returns 401, with no body worth parsing.

Treat 401 as do not retry. Nothing about sending the same request again will change the answer — the key needs to be replaced. Retrying a bad key in a loop is how integrations end up locked out.

Keeping the key safe​

The key is a credential. The same care as a password:

  • Never in source control, never in a URL, never in a log line
  • In an environment variable, a secrets manager, or an encrypted config file
  • Rotate it if anyone who had access leaves

If a key leaks, ask for it to be revoked. Revocation is immediate, and generating a replacement takes seconds.