Every endpoint needs a bearer token. Create one under Settings > API
Tokens (/settings/api-tokens) and send it with every request:
code
Authorization: Bearer YOUR_TOKEN
A request without a valid token gets a 401:
json
{
"message": "Unauthenticated."
}
Managing tokens
- A token is shown only once, when you create it. Keep it in your secret manager, not in source control.
- When you revoke a token, it stops working right away.
- Tokens belong to your team, and usage is counted per team.
In the SDK and CLI
The PHP SDK takes the token as a constructor argument. The
CLI stores it when you run cpx glimpse auth, or reads it from the
GLIMPSE_TOKEN environment variable, which is useful in CI. All CLI image commands
also run without a token of your own: the CLI falls back to a built-in
public token for analyze, info, convert, optimize, resize, and thumbnail.
Account and usage endpoints require a personal token. The SDK always
requires an explicitly supplied token and does not retry automatically. See
Add Glimpse to Your Project for workflow setup.