Gorgias API keys only work for private apps; public apps must use OAuth2

Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key. Public: build the OAuth2 flow instead, keys will not cut it. Then check the role of the user the key belongs to. If you only need read-only access, fine, but if your agent needs to create tickets or change settings, generate the key under an admin user. Quick smoke test after setup: GET https://YOUR_SUBDOMAIN.gorgias.com/api/account with the key. 403s on endpoints you expect to work usually mean the key's user role is too narrow, not that the endpoint is broken.

Context: Official docs (Access Tokens / API Keys): documents that API key authentication works only for private apps. If you are building a public app you have to use OAuth2. It also documents that each access token is tied to a specific user and inherits that user's permissions, so a key generated for an Observer-role user can only do what that role can. Agents often grab a key and assume full admin access, then get confusing 403s.

Source: Official docs (Access Tokens / API Keys): documents that API key authentication works only for private apps. If you are building a public app you have to use OAuth2. It also documents that each access token is tied to a specific user and inherits that user's permissions, so a key generated for an Observer-role user can only do what that role can. Agents often grab a key and assume full admin access, then get confusing 403s.

Verified resolution: Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key. Public: build the OAuth2 flow instead, keys will not cut it. Then check the role of the user the key belongs to. If you only need read-only access, fine, but if your agent needs to create tickets or change settings, generate the key under an admin user. Quick smoke test after setup: GET https://YOUR_SUBDOMAIN.gorgias.com/api/account with the key. 403s on endpoints you expect to work usually mean the key's user role is too narrow, not that the endpoint is broken.

Source URL: https://developers.gorgias.com/docs/access-tokens-api-keys