Skip to main content
Every Gloo AI API endpoint requires authentication: a single API key passed in the Authorization header. This tutorial gets your key into an environment variable, sends it on a real request, and checks that it works. API keys (sk_...) are the default: one key, sent directly as the Bearer value, with no token exchange or expiry handling. Client ID / Client Secret with OAuth2 access tokens is the legacy path, still supported for existing integrations but deprecated. If you maintain one, jump to Legacy: client credentials and OAuth.

What you’ll do

  1. Set your API key - Store it securely in an environment variable
  2. Send the key in API calls - Include it in the Authorization header of every request
  3. Test your setup - Run a quick request to confirm the key works

Prerequisites

Before starting, ensure you have:
  • A Gloo AI Studio account
  • Your API key from the API Keys page
  • PHP 8.0 or later, if you follow the PHP examples

Step 1: Set your API key

Create a .env file in your project root:
For Go and Java, you can also export it directly:
Never hardcode your key, add .env to your .gitignore so the key never reaches source control, use the key only on your server, and never log it. See API Key Security. For retrying transient failures, see Error Handling and Retries.

Step 2: Send the key in API calls

Send the key in the Authorization header of every request:
The examples below call Completions V2 (/ai/v2/guarded/chat/completions). The same API key works on the Responses API (/ai/v2/guarded/responses). So does Direct Responses. Only the URL and request shape differ.

Step 3: Test your setup

Verify your setup with a simple test:

Complete code

View Complete Code

Clone or browse the complete working examples for all 6 languages (JavaScript, TypeScript, Python, PHP, Go, Java) with setup instructions.

Troubleshooting

Cause: Invalid or missing API keySolution: Verify your GLOO_API_KEY is set correctly and has not been revokedUsing legacy client credentials? A 401 usually means the access token expired. See Legacy: client credentials and OAuth.
Cause: Insufficient permissions, or a malformed or revoked API keySolution: Check your API access levels in the Studio and confirm the key has not been revoked

Legacy: client credentials and OAuth

Legacy and deprecated, sunset by December 2026. The OAuth2 client credentials flow below still works for existing integrations, but new integrations should use the API key authentication shown above. To migrate, create an API key in Studio and send it directly as the Bearer value; you can then delete the token exchange, expiry check, and refresh code in this section.
Existing OAuth2 integrations exchange a Client ID and Client Secret for a temporary access token at the token endpoint. Access tokens obtained through the OAuth2 flow expire after one hour, so legacy integrations need to refresh them.

Next steps

Use your key in other Gloo AI tutorials:

Build with Direct Responses

Make your first call, stream answers, and hold a multi-turn conversation.

Responses API

Build on the guarded Responses API: text, vision, image generation and tool use.

Using the Completions API

Generate text completions, including model selection, model_family and grounded completions.

API Reference

Explore all available endpoints.
New to tools? See Tools and MCP. Grounded completions are explained in Endpoint types.