API keys
A ToolGlue key looks like tg_xxxxxxxx_... and works as a standard
bearer token. It is shown once at creation and stored only as a hash.
Using a key
Send the key in the Authorization header against the MCP endpoint
(/mcp) or the REST API (/api):
curl -H "Authorization: Bearer tg_YOUR_KEY" https://toolglue.dev/api/pingKeys and OAuth tokens are interchangeable on these endpoints; both carry the same workspace and scope information. Browser cookies are never accepted on machine routes.
Scopes
Each key carries only the scopes you tick when minting it:
| Scope | Allows |
|---|---|
mcp |
Connect to the MCP endpoint at all |
connections:read |
List and inspect connections |
connections:write |
Create and remove connections |
actions:run |
Run tools with act (spends balance) |
actions:build |
Create and rebuild tools with AI (spends balance) |
credentials:read |
Raw credential export. Off by default, Owner-minted only |
admin |
Key management, ledger reads, workspace settings via API |
Lifecycle
- Reveal once. The full key appears only at creation. The list page shows the prefix, the scopes, the expiry, and when the key was last used.
- Revoke instantly. Revoking on the Keys page takes effect within about 30 seconds everywhere. A revoked or expired key gets a clear 401.
- Expiry. Optional at mint time. Expired keys stop working and are flagged in the audit log if they are still being tried.
- Rate limit. Each key gets a per-minute request budget (60 per minute by default) on the REST API.