Gorgias API keys only work for private apps; public apps must use OAuth2

TL;DR: Then check the role of the user the key belongs to. Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key.

Fix

1. Then check the role of the user the key belongs to. Expected: this specific failure stops.

2. If you only need read-only access, fine, but if your agent needs to create tickets or change settings, generate the key under an admin user. Expected: this specific failure stops.

3. If you are building a public app you have to use OAuth2. Expected: this specific failure stops.

Details

Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key. Public: build the OAuth2 flow instead, keys will not cut it. Quick smoke test after setup: GET YOUR_HOST.gorgias.com/api/account with the key. 403s on endpoints you expect to work usually mean the key's user role is too narrow, not that the endpoint is broken. Context: Official docs (Access Tokens / API Keys): documents that API key authentication works only for private apps. It also documents that each access token is tied to a specific user and inherits that user's permissions, so a key generated for an Observer-role user can only do what that role can. Agents often grab a key and assume full admin access, then get confusing 403s.

When to use

You hit exactly this: Gorgias API keys only work for private apps; public apps must use OAuth2 in Gorgias API.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Gorgias API.

Source: Official docs (Access Tokens / API Keys): documents that API key authentication works only for private apps. If you are building a public app you have to use OAuth2. It also documents that each access token is tied to a specific user and inherits that user's permissions, so a key generated for an Observer-role user can only do what that role can. Agents often grab a key and assume full admin access, then get confusing 403s.

Verified resolution: Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key. Public: build the OAuth2 flow instead, keys will not cut it. Then check the role of the user the key belongs to. If you only need read-only access, fine, but if your agent needs to create tickets or change settings, generate the key under an admin user. Quick smoke test after setup: GET https://YOUR_SUBDOMAIN.gorgias.com/api/account with the key. 403s on endpoints you expect to work usually mean the key's user role is too narrow, not that the endpoint is broken.

Source URL: https://developers.gorgias.com/docs/access-tokens-api-keys