Developers / API
The Developers / API page (/settings/developers) allows you to manage public API keys to connect Gordon CRM data to external websites, portals, or frontend applications.
Public API Keys
Each workspace has a single active public API key used to authorize read-only requests for public endpoints (such as the public events feed).
Generating a Key
If your workspace does not have a key configured:
- Click Generate API Key.
- Copy the full key (prefixed with
pk_live_) from the screen.
Warning: For security reasons, the full API key is only shown once upon generation. If you leave the page, the key will be masked (e.g.,
pk_live_abc1••••••••) and cannot be recovered. Store it securely in your password manager or environment files.
Regenerating a Key
If you suspect your key has been exposed, or you need to cycle credentials:
- Click Regenerate Key.
- Confirm the warning message:
"This will immediately invalidate your current API key. Any website using the old key will stop receiving events..."
- Copy the newly generated key.
API Key Security
To prevent unauthorized access to your workspace data:
- Never expose your API key in frontend code (such as React, Vue, or static HTML script blocks on a public website).
- If you need to retrieve event listings directly from your website's frontend code, configure a secure server-side proxy to hold the key and query the CRM API on your behalf.
Related
- Events → Public Events API — Learn how to fetch and render event listings on external websites
- Forms → Server Integration — Capture form submissions from server environments using form-specific API keys
- Technical Reference: Settings — API key hashing mechanisms and database prefix tracking details