Authentication

Send your key in the Authorization header on every request. GearDex validates the key, subscription access, expiration, revocation status, rate limit, requested scope, and resource ownership before returning Studio data.

1. Open Settings → API & Agents.
2. Choose a name that identifies the service using the key.
3. Select the minimum required scopes.
4. Set an expiration date appropriate for the integration.
5. Copy the key once and store it in your secret manager.

The bearer token belongs in the header—not in a query string or JSON body.

curl -X GET "https://www.geardex.app/api/studio-agent/v1/gear?limit=3" \
  -H "Authorization: Bearer gdx_live_your_key_here" \
  -H "Accept: application/json"

const response = await fetch("https://www.geardex.app/api/studio-agent/v1/gear?limit=3", {
  headers: {
    Authorization: `Bearer ${process.env.GEARDEX_STUDIO_API_KEY}`,
    Accept: "application/json",
  },
})

if (!response.ok) {
  throw new Error(`GearDex request failed: ${response.status}`)
}

const payload = await response.json()

• Use one key per application, agent host, or automation.
• Prefer short, explicit expiration windows.
• Rotate secrets without changing the integration's scope model.
• Revoke a key immediately when a machine or service is retired.
• Review activity logs for unexpected endpoints or request volume.