Authentication

The Glanevo API supports two methods: Bearer token (recommended) and OAuth2 (for 3rd party apps).

1. Bearer token (recommended)

Each tenant generates a token from its own Glanevo panel. Token format: glv_+ 64 hex characters. Stored as a SHA-256 hash — the plain value is visible only at the moment it's generated.

Go to Panel → Settings → API Keys.
"Generate new key" → choose a name and scopes.
Copy the plain token once — save it somewhere secure.
Use Authorization: Bearer glv_... in your requests.

2. OAuth2 (3rd party apps)

OAuth2 authorization code flow for 3rd party apps listed on the Marketplace. Contact: developers@glanevo.com

GET https://api.glanevo.com/oauth/authorize
  ?client_id=...
  &redirect_uri=...
  &scope=customers.read appointments.read
  &response_type=code
  &state=<csrf>

Scopes

Scope	Description
customers.read	Read customer list
customers.write	Create/update customers
appointments.read	Read appointment list
appointments.write	Create/update appointments
services.read	Read service catalog
payments.read	Read payment list
reviews.read	Read customer reviews
webhooks.write	Manage webhook subscriptions

Rate limiting

Every response includes three headers:

X-RateLimit-Limit — the quota within the window
X-RateLimit-Remaining — remaining request allowance
X-RateLimit-Reset — the UNIX timestamp when the window resets

Plan	Hourly limit
Free	100 / hour
Pro	10,000 / hour
Enterprise	Unlimited (fair use)

Error codes

401 Unauthorized — Token missing / invalid / revoked
403 Forbidden — Token not authorized for this scope
404 Not Found — Resource doesn't exist in this tenant
422 Unprocessable — Validation error
429 Too Many Requests — Rate limit exceeded
5xx — Server error, retry recommended