Skip to main content
Get Started

Authentication Overview

Glean provides two main authentication methods to access its APIs, each with different capabilities and use cases. This guide will help you understand the concepts and choose the right approach for your integration.

Finding Your Server URL​

All Glean API requests require your organization's server URL. The server URL is used in API endpoints and API Client/SDK configuration.

How to Find Your Server URL​

  1. Navigate to the About Page: Visit https://app.glean.com/admin/about-glean in your Glean admin console
  2. Locate Server URL: Find the "Server instance (QE)" field — this is your server URL

Example​

If the field shows: https://acme-prod-be.glean.com/ Your server URL is: https://acme-prod-be.glean.com

Usage in APIs​

Your server URL is used in:

  • API Base URLs:
    • Client API: https://acme-prod-be.glean.com/rest/api/v1/
    • Indexing API: https://acme-prod-be.glean.com/api/index/v1/
  • API Client/SDK Configuration: Set as GLEAN_SERVER_URL environment variable

API Types and Implementation Guides​

Glean offers two distinct APIs with different authentication capabilities. Choose your API type to get started:

Client API Authentication

For end-user applications and integrations

  • Search, chat, collections, agents
  • User-facing functionality
  • OAuth (recommended) + Glean tokens
  • Base URL: https://<your-server-url>/rest/api/v1/

Implementation Guide →

Indexing API Authentication

For administrative operations and content management

  • Document indexing, datasource management
  • Administrative operations
  • Glean tokens only (no OAuth support)
  • Base URL: https://<your-server-url>/api/index/v1/

Implementation Guide →

Authentication Methods​

Supported APIs:Client API

OAuth is the recommended method for Client API integrations. Two options are supported:

  • Glean OAuth Authorization Server (recommended for new integrations): Glean issues OAuth tokens with Glean-defined scopes via Authorization Code + PKCE. No IdP OAuth setup is required — users are directed through your SSO provider automatically as part of authorization. This is also the mechanism behind the remote MCP server.

  • IdP-issued tokens: use OAuth tokens from Google Workspace, Microsoft Entra ID (Azure AD), Okta, or OneLogin if you already operate OAuth in your identity provider.

  • Supported APIs: Client API only

  • Benefits: No manual token management, standards-based (OAuth 2.0 + PKCE), seamless SSO login

Glean-Issued Tokens​

Supported APIs:Client APIIndexing API

Glean-issued tokens are manually created through the admin console and offer granular control over permissions and access.

  • Supported APIs: Both Client API and Indexing API
  • Types: User-scoped, Global (super admin only)
  • Benefits: Granular scope control, works with both APIs

Quick Decision Guide​

Which Authentication Method Should I Use?

For Client API integrations:

  • Choose OAuth for new integrations — the Glean OAuth Authorization Server requires no IdP OAuth infrastructure (IdP-issued tokens remain supported if you already run OAuth in Google, Entra ID, Okta, or OneLogin)
  • Choose Glean tokens for server-to-service integrations or when you need admin-managed token lifecycle

For Indexing API operations:

  • Must use Glean tokens (OAuth is not supported)

For applications using both APIs:

  • Use OAuth for Client API operations + separate Glean token for Indexing API operations

User Roles and Permissions​

Understanding who can create what type of authentication tokens:

RoleClient API TokensIndexing API Tokens
Super AdminCreate for any scope, including globalCreate
AdminCreate for any scope except globalCreate
Setup AdminCannot createCreate (Indexing API only)
API Token CreatorCreate, scoped to themselvesCreate, scoped to themselves

See the Administrator Roles matrix for the authoritative permission breakdown. OAuth access is configured separately in the Admin console — see the Client API authentication overview.

Security Best Practices​

Regardless of which authentication method you choose:

  • Store tokens securely - Never commit tokens to version control
  • Use environment variables for token storage in applications
  • Implement token rotation for long-running applications
  • Monitor token usage through Glean's admin console
  • Use minimal scopes when creating Glean tokens
  • Implement proper error handling for authentication failures

Need Help?​

  • Community: Join discussions at community.glean.com
  • Support: Contact your Glean administrator for token creation access
  • Documentation: Detailed implementation guides linked above

Next Steps​

  1. Determine your use case: Client API, Indexing API, or both?
  2. Choose authentication method: OAuth (Client API) or Glean tokens
  3. Follow the implementation guide: Use the links above for detailed setup instructions
  4. Test your integration: Verify authentication works before building your application