Authentication - GlassMarkets API

The API accepts two credentials, both sent in the Authorization header:

A login token, from logging in with your email and password. It works on every endpoint.
An API key, created in the app. It works only on the endpoints its scope allows, and is the one to use for scripts that only read data and for the API reference playground.

Which method works where

Endpoints	Login token	API key scope
`/v2/metrics/*`, including the CSV `POST` exports	Yes	`metrics:read`
`POST /v2/organizations/reported-metrics/`	Yes	`reported_metrics:write`
`GET /v1/organizations/`	Yes	`reported_metrics:write` or `mm_metrics:read`
`GET /v2/organizations/reported-metrics/exchanges/`	Yes	`reported_metrics:write` or `mm_metrics:read`
`GET` on `/v2/organizations/trusted-metrics/`, `reported-metrics/`, `market-maker-metrics/` and `targets/`	Yes	`mm_metrics:read`
Every other endpoint	Yes	Not accepted

Log in

Send your email and password to POST /v1/login/:

curl -X POST https://api.glassmarkets.io/v1/login/ \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'

The response contains the token and the time it expires:

{
  "expiry": "2026-09-02T10:15:00Z",
  "token": "9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b",
  "user": {
    "username": "you@example.com",
    "first_name": "Ada",
    "id": 42,
    "last_name": "Lovelace",
    "email": "you@example.com"
  }
}

A missing or wrong email or password returns 400. Login is rate limited. Log in once and reuse the token until it expires, instead of logging in before every request.

Send the token

Add the header to every request. The word Token and the space after it are required:

Authorization: Token <token>

curl https://api.glassmarkets.io/v1/organizations/ \
  -H "Authorization: Token <token>"

Token lifetime

Situation	The token is valid for
Default	1 day after its last use
Logged in with `"remember_me": true`	At least 7 days
Any token	At most 30 days after login

A request with a missing, expired or revoked token returns 401. Log in again to get a new token.

Two-factor authentication

If your account has two-factor authentication, POST /v1/login/ returns 202 with a challenge instead of a token:

{
  "two_factor_required": true,
  "challenge_id": "..."
}

Send the challenge_id with the code from your authenticator app to POST /v1/totp/login/:

curl -X POST https://api.glassmarkets.io/v1/totp/login/ \
  -H "Content-Type: application/json" \
  -d '{"challenge_id": "...", "code": "123456"}'

If the challenge also includes "method": "email", GlassMarkets sends a six-digit code to your account email. Submit that code and the same challenge_id to POST /v1/email-2fa/login/ instead. Email verification is available to accounts created through an organization invitation. If you choose an authenticator app, password sign-in uses that app. Both endpoints return the same response as a normal login.

Log out

POST /v1/logout/ revokes the token that made the request. Other tokens of the same account stay valid.

curl -X POST https://api.glassmarkets.io/v1/logout/ \
  -H "Authorization: Token <token>"

API keys

An API key acts as your account, with your account’s current data access, but only on the endpoints its scope allows. A key does not expire with your login session, so use one for scripts instead of a login token.

Create a key

In the GlassMarkets app, open the account menu and choose Settings.
Next to API keys, choose Manage API keys.
Enter a Key name, tick the Permissions the key needs, and enter your current password. If your account has two-factor authentication, also enter an authentication or recovery code.
Choose Create key and copy the key. It starts with gm_live_ and is shown only once.

Permission	Scope	Allows
Read metrics	`metrics:read`	Every `/v2/metrics/*` request
Submit reported metrics	`reported_metrics:write`	Pushing reported metrics, and listing your organizations and the venues you report for
Read market maker data	`mm_metrics:read`	Reading your trusted and reported metrics, market maker metrics, targets and target compliance, and listing your organizations

A key expires one year after it is created. An account can have up to 20 active keys. Changing or resetting your password revokes all of them.

Send the key

Add the header to every request. The word ApiKey and the space after it are required:

Authorization: ApiKey <key>

curl -G https://api.glassmarkets.io/v2/metrics/volume/ \
  -H "Authorization: ApiKey <key>" \
  -d assets=BTC -d interval=1d -d lookback=7-days

Try requests in the API reference

The pages in the API reference tab that accept API keys have a playground for sending a request from the page. Use a key with only metrics:read there, created just for the playground, and revoke it when you are done. The playground sends the key to the API through the docs site’s proxy. Listing your organizations with GET /v1/organizations/ needs a key with reported_metrics:write or mm_metrics:read. A metrics:read key gets 403 on that page.

Revoke a key

In Settings → Manage API keys, choose Revoke next to the key. The key stops working immediately.

Errors

A wrong, expired or revoked key returns 401:

{
  "detail": "Invalid or expired API key."
}

A valid key used on an endpoint its scope does not cover, or on an endpoint that does not accept API keys, returns 403:

{
  "detail": "API key does not have access to this endpoint."
}

POST /v1/logout/ accepts only login tokens and returns 401 for an API key.