API keys: where to find them and what they can see

Every call to the Gorilla Dash API carries two headers: a key that says who you are, and an access token that proves it. There is no login step, no token to refresh and no expiry — the same two values work on every call, forever, until someone regenerates them.

The two headers

Header	Value
`GorillaDash-Api-Key`	Your API key. Identifies the organisation or tribe.
`GorillaDash-Api-Secret`	Your access token. Proves the key is yours.

Both are required on every call. Send only one, or send a pair that does not match, and you get 401 Unauthenticated — the API deliberately does not tell you which of the two was wrong.

Getting your organisation key

Open Organisation Settings.
Choose Connections from the settings menu.
Under Gorilla Dash API you will see Organisation API Key and Organisation API Access Token. Each has a copy button.

You need the Edit Organisation Settings permission to open this screen. That is deliberate — the credentials are not shown anywhere in the wider settings, so an ordinary user cannot stumble across them.

Getting a tribe key

Every tribe has its own key and access token as well. Open the tribe, go to its Administrators screen, and look for the Gorilla Dash API section near the bottom.

What each kind of key can see

This is the single most important thing to get right before you build. The key you choose decides what the API will show you, and there is no way to widen it at call time.

	Organisation key	Tribe key
Contacts and leads	Every one in the organisation	Only those linked to that tribe
Tribes	All of them	Only itself
Knowledge articles, food menu, digest posts, enquiry forms	The organisation's	The parent organisation's — the same set an organisation key sees
Blog articles, media	The organisation's	Only the ones linked to that tribe
Reviews	The organisation's	Only that tribe's own reviews
Filter by a specific tribe	Yes, with `tribe_id`	No — asking for another tribe is refused with 403
Tribe search	Yes	No — refused with 403
Push a lead	Yes, to any tribe	Yes, always to itself

HOW TO CHOOSE

Give a single tribe's website a tribe key: it cannot leak a sibling tribe's data even if the site is misconfigured. Use an organisation key for anything that has to see the whole network — a head office dashboard, a sync into your CRM, a store locator.

A tribe key is not silently narrowed — it is refused. If you send a tribe key and also ask for a different tribe with tribe_id, the API answers 403 rather than quietly returning nothing, so a mistake shows up straight away instead of looking like an empty result.

Regenerating the access token

The Connections screen has a Regenerate button. It issues a new access token for the organisation and invalidates the old one immediately.

REGENERATING BREAKS EVERY LIVE INTEGRATION AT ONCE

There is no grace period and no second token. The moment you regenerate, every website, automation and script still using the old access token starts getting 401s. Have the list of places to update ready before you click it — and do it when someone is available to fix what breaks.

Keeping the credentials safe

Treat the access token like a password. Anyone holding the pair can read your contacts.
Never put them in browser JavaScript, a mobile app, or anything a visitor can view the source of. Calls belong on your server.
Keep them out of source control. Use whatever your platform offers for secrets.
Prefer a tribe key wherever a tribe key is enough — a leak then costs you one tribe, not the network.
Regenerate if you think the pair has been exposed, and update your integrations the same day.

When correct credentials still fail

A 403 with a message about RESTful API access means the credentials were accepted but the API is switched off for your organisation. Someone has turned on Disable RESTful API in Organisation Settings, then Gorilla Settings. Turning it off restores access instantly, for the organisation and every tribe under it.