API
API keys: where to find them and what they can see
How to get your Gorilla Dash API key and access token, how to send them, and the difference between an organisation key and a tribe key.
Last updated September 2, 2026
Every call to the Gorilla Dash API carries two headers: a key that says who you are, and an access token that proves it. There is no login step, no token to refresh and no expiry — the same two values work on every call, forever, until someone regenerates them.
The two headers
| Header | Value |
|---|---|
GorillaDash-Api-Key | Your API key. Identifies the organisation or tribe. |
GorillaDash-Api-Secret | Your access token. Proves the key is yours. |
Both are required on every call. Send only one, or send a pair that does not match, and you get 401 Unauthenticated — the API deliberately does not tell you which of the two was wrong.
Getting your organisation key
- Open Organisation Settings.
- Choose Connections from the settings menu.
- Under Gorilla Dash API you will see Organisation API Key and Organisation API Access Token. Each has a copy button.
You need the Edit Organisation Settings permission to open this screen. That is deliberate — the credentials are not shown anywhere in the wider settings, so an ordinary user cannot stumble across them.
Getting a tribe key
Every tribe has its own key and access token as well. Open the tribe, go to its Administrators screen, and look for the Gorilla Dash API section near the bottom.
What each kind of key can see
This is the single most important thing to get right before you build. The key you choose decides what the API will show you, and there is no way to widen it at call time.
| Organisation key | Tribe key | |
|---|---|---|
| Contacts and leads | Every one in the organisation | Only those linked to that tribe |
| Tribes | All of them | Only itself |
| Knowledge articles, food menu, digest posts, enquiry forms | The organisation's | The parent organisation's — the same set an organisation key sees |
| Blog articles, media | The organisation's | Only the ones linked to that tribe |
| Reviews | The organisation's | Only that tribe's own reviews |
| Filter by a specific tribe | Yes, with tribe_id | No — asking for another tribe is refused with 403 |
| Tribe search | Yes | No — refused with 403 |
| Push a lead | Yes, to any tribe | Yes, always to itself |
A tribe key is not silently narrowed — it is refused. If you send a tribe key and also ask for a different tribe with tribe_id, the API answers 403 rather than quietly returning nothing, so a mistake shows up straight away instead of looking like an empty result.
Regenerating the access token
The Connections screen has a Regenerate button. It issues a new access token for the organisation and invalidates the old one immediately.
Keeping the credentials safe
- Treat the access token like a password. Anyone holding the pair can read your contacts.
- Never put them in browser JavaScript, a mobile app, or anything a visitor can view the source of. Calls belong on your server.
- Keep them out of source control. Use whatever your platform offers for secrets.
- Prefer a tribe key wherever a tribe key is enough — a leak then costs you one tribe, not the network.
- Regenerate if you think the pair has been exposed, and update your integrations the same day.
When correct credentials still fail
A 403 with a message about RESTful API access means the credentials were accepted but the API is switched off for your organisation. Someone has turned on Disable RESTful API in Organisation Settings, then Gorilla Settings. Turning it off restores access instantly, for the organisation and every tribe under it.