Authentication

This section describes authentication and authorization for the Glofox API. All API requests must include x-api-key and x-glofox-api-token. Most endpoints also require x-glofox-branch-id.

Exception: POST /v3.0/locations/retrieve does not require x-glofox-branch-id. That call returns locations from the integrator token (assigned locations or namespaces).

Get started

First, you need API credentials. Follow Get started to create an account, log in, and submit an access request. See Request access.

You receive credentials that grant access to the development endpoints. The Glofox API provides dedicated development, testing, staging, and sandbox environments to support end‑to‑end validation. Glofox issues two sets of tokens/keys: one for development/testing and one for production. Both sets point to the same environment configuration. The API supports webhook configuration. You need access to the Glofox Dashboard to complete development and testing workflows.

Make your first API call

After you have credentials, confirm they work with a simple GET to list members at a location.

• Base URL: https://gf-api.aws.glofox.com/prod/
• Endpoint: /2.0/members
• Method: GET

Required headers

curl -X GET "https://gf-api.aws.glofox.com/prod/2.0/members" \
  -H "x-glofox-branch-id: {branch_id}" \
  -H "x-api-key: {api_key}" \
  -H "x-glofox-api-token: {api_token}"

Expected response

A successful call returns HTTP 200 and a paginated list of members (API users of type member). Example:

{
  "object": "list",
  "page": 1,
  "limit": 2,
  "has_more": true,
  "total_count": 137,
  "data": [
    {
      "_id": "62d9e7d8e803e136a87b7367",
      "first_name": "Canada",
      "last_name": "Address",
      "email": "[email protected]",
      "type": "member",
      "branch_id": "6213afed9ead8f3e7b0e3574",
      "namespace": "locnamespace",
      "active": true,
      "name": "Canada Address",
      "role": "member"
    }
  ]
}

For the full schema and interactive examples, see Users in the API Reference.

Next flows

• Lead capture and sale flow—register a member and complete a sale
• Bookings workflow—list classes and create bookings

For a one-page cheat sheet of headers, base URLs, rate limits, and contacts, see Quick reference.

Security and rate limiting

The API applies security validations and rate limits. The main measures are those listed below.

Backend proxies: perform all API key and token operations through a secure backend service. This prevents direct client‑side access and protects sensitive credentials. Use API keys and tokens exclusively for backend integrations. Never expose them in browsers or other public-facing environments. Implement strong credential lifecycle management, including rotation, and secure storage.

Rate limiting: the API enforces per-second limits and burst allowances:

• Live accounts: 10 requests per second with a burst of 1000.
• Sandbox accounts: 3 requests per second with a burst of 300.

See Quick reference for a compact table of rate limits and base URLs.