Public API
Automate managed domains, scaling, and scaling schedules for your Meteor apps with scoped Galaxy API credentials.
The Galaxy Public API is a REST API for automating a small, deliberate set of operations on your apps. It replaces the legacy GraphQL API for customer automation.
What you'll need: A Meteor app on the Professional plan
Who can create credentials: The account owner, or an owner or admin of the organization that owns the app
What You Can Automate
The API covers operational tasks you'd otherwise click through in the dashboard. It doesn't expose deployments, environment variables, or billing.
Applications: List the applications assigned to a credential, with status, service type, and region.
Managed domains: Read metadata for every domain on an app. Create, re-verify, and delete custom domains that use Galaxy-managed TLS.
Scaling: Read and change the desired container count and the container specification.
Scaling schedules: Create one-time or daily recurring container count changes, list recent schedules, and cancel pending ones.
Production base URL: https://api.galaxycloud.app
The full endpoint reference, request and response schemas, and an interactive Test Request console live at api.galaxycloud.app/public/docs. The OpenAPI 3.1 contract is published at /public/openapi.json if you'd rather generate a client.
Create a Credential
Credentials are created in the Galaxy dashboard, not through the API.
Open Public API Access
Head to Settings, then Public API under API & Integrations. Organizations have their own Public API page in organization settings, separate from your personal account.
Click Create credential
The button sits at the top of the page, next to Documentation. If it's disabled, hover it: the tooltip explains why, usually because the account has no eligible application yet.
Name the credential
Use the Name field and describe what the integration does, like Production domain automation. You get up to 80 characters.
Pick your applications
Select at least one app under Applications. Only Meteor apps on the Professional plan in this account show up here.
Pick your capabilities
Capabilities starts with public:apps:read checked. Add whatever else the integration needs. Write capabilities automatically pull in their matching read capability.
Set an expiration
Expires on defaults to 90 days from today. The earliest you can pick is tomorrow, the latest is 365 days out.
Copy your token
Submit the form and Galaxy shows the token once. Copy it into your secret manager, tick the box confirming you've saved it, then click Done. You can't close that dialog any other way.
Send the token as a bearer token on every request:
curl https://api.galaxycloud.app/public/v1/apps \
-H "Authorization: Bearer gxy_v1.your-token-here"Scopes
Every request needs both the right scope and an app that's on the credential's allowlist. Apps that aren't listed, and apps belonging to another owner, return 404 instead of 403 so the API never confirms they exist.
public:apps:read: Lists the applications assigned to the credential.
public:domains:read: Reads domain metadata for those applications.
public:domains:write: Creates, re-verifies, and deletes custom domains that use Galaxy-managed TLS. Requires public:domains:read.
public:scaling:read: Reads container counts, container specifications, and scaling schedules.
public:scaling:write: Changes scaling state and manages scaling schedules. Requires public:scaling:read.
Custom certificates and Galaxy subdomains aren't part of the public contract. Manage those in the dashboard.
Rotation and Revocation
Both actions live in the actions menu at the end of each row in the credential list, and both ask for confirmation first.
Rotate a credential when a token may have leaked, or on whatever schedule your security policy sets. Rotation issues a new token and keeps the previous one valid for 15 minutes, so your workers have time to pick up the new value. The dialog tells you the exact time the old token stops working.
Revocation is immediate and permanent. A revoked credential can't authenticate again, and you can't undo it.
Tokens Are Shown Once
Galaxy stores a hash, not the token. If you lose it, rotate the credential to get a new one.
Retries, Request IDs, and Rate Limits
Domain mutations and scaling schedule mutations require an Idempotency-Key header. Generate a unique value per logical operation and reuse it only when retrying the exact same request. Galaxy replays the completed response for 24 hours; reusing a key with a different operation or payload returns 409.
Every automation response includes an X-Request-ID. Send your own identifier (visible ASCII, up to 128 characters) to correlate requests with your own logs, or let Galaxy generate one.
Default rate limits are 120 requests per minute per credential and 600 requests per minute per owner. A 429 response includes Retry-After with the number of seconds to wait.
Common Questions
Something Not Behaving as Documented?
Include the X-Request-ID from the failing response when you contact support. It's the fastest way for us to find your request.