Authentication

Authentication works in both directions and uses, in both, the Authorization header.

When you call us

Every request to the API carries your API key on Authorization:

POST /api/v3/menu/upload HTTP/1.1
Host: prod.store-management.glovo.alb.app.onlineservice.io
Authorization: your-api-key
Content-Type: application/json

The Bearer prefix is accepted but not required — both forms below are treated identically:

Authorization: your-api-key
Authorization: Bearer your-api-key

Keys are created and read in the portal, under Profile → API keys. See API keys.

Situation	Response
Header missing or empty	401 Unauthorized
Unknown or inactive key	401 Unauthorized
Valid key	the request is processed

When we call you

Every order we send carries, also on Authorization, the value of the API key you associated with that endpoint in the portal.

POST /your-webhook HTTP/1.1
Authorization: the-key-configured-on-the-endpoint
Content-Type: application/json

{ "order_code": "ISRQHPPK1", ... }

Check it. Your endpoint is public on the internet; this header is the only thing separating a real order from a request sent by anyone else.

Do not reuse one key everywhere

The key you call us with and the key you expect from us can be different, and it is healthier if they are. If one leaks, you can rotate it without stopping the other direction.

Rotating a key

1. Create a new key in the portal.
2. Attach it to your endpoints and temporarily accept both values in your validation.
3. Switch your own calls to the new key.
4. Delete the old key from the portal and drop it from your validation.

Step 2 avoids the window in which orders would be rejected because you already expect the new key while we are still sending the old one.

Rate limits

Operations are not rate-limited per key, with one exception: full menu updates are capped at 5 per day per store.