Skip to main content
The Gately API uses API key authentication. Your API key contains the project context, so authentication is simple and straightforward.

​
API Keys

API keys are used for all API communication. They provide full access to your project’s data and automatically include the project context.

​
Creating an API Key

  1. Go to your Gately dashboard
  2. Navigate to Settings > API Keys
  3. Click Create API Key
  4. Give your key a descriptive name
  5. Copy and securely store the key (it won’t be shown again)

​
Using API Keys

Include the API key in the Authorization header: 
curl -X GET "https://api.usegately.com/api/v1/members" \
  -H "Authorization: Bearer YOUR_API_KEY"
Never expose API keys in client-side code. They should only be used in server-side applications.

​
API Key Prefixes

PrefixEnvironment
gately_sk_live_Production
gately_sk_test_Test/Development

​
JWT Tokens (Client-side)

JWT tokens are used for client-side authentication when users log in to your application.

​
Obtaining a JWT Token

const { session } = await gately.login('[email protected]', 'password')
const token = session.access_token

​
Using JWT Tokens

curl -X GET "https://api.usegately.com/api/v1/user/profile" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

​
Token Expiry

Token TypeExpiry
Access Token1 hour
Refresh Token7 days

​
Refreshing Tokens

const { session } = await gately.refreshSession()
Or via API: 
curl -X POST "https://api.usegately.com/api/v1/auth/refresh" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"refresh_token": "your-refresh-token"}'

​
Authentication Summary

MethodAuthorization HeaderUse Case
API KeyBearer gately_xxxxxServer-to-server
JWT TokenBearer eyJhbG...Client-side apps

​
Security Best Practices

Create new API keys periodically and revoke old ones to minimize risk.
Store API keys in environment variables, never in source code.
Create separate keys for different services with minimal required permissions.
Regularly review API key usage in your dashboard to detect anomalies.

​
Error Responses

​
Invalid Token

{
  "success": false,
  "error": "Invalid or expired token",
  "code": "INVALID_TOKEN"
}

​
Missing Authentication

{
  "success": false,
  "error": "Authentication required",
  "code": "AUTH_REQUIRED"
}