Skip to main content

​
Authentication

All requests to the Gomry API must include a valid API key. API keys are scoped to your organization — any event, attendee, or ticket class belonging to your organization is accessible with your key.

​
Generating an API Key

  1. Log in to your Gomry dashboard
  2. Navigate to Organization Settings → API Keys
  3. Click Create API Key and give it a descriptive name
  4. Copy the key immediately — it is only displayed once
Treat your API key like a password. Anyone with your key can read your organization’s event data. Never commit it to version control or expose it in client-side code.

​
Using Your API Key

Include the key in the X-API-KEY header on every request: 
curl -H "X-API-KEY: your_api_key_here" \
  https://www.gomry.com/api/v1/events/YOUR_EVENT_ID

​
Security Best Practices

Never hardcode API keys in your source code. Use environment variables or a secrets manager.
export GOMRY_API_KEY="your_api_key_here"
API keys should only be used in server-side code. Never include them in frontend JavaScript, mobile apps, or any code that runs on user devices.
Create a new key and revoke the old one periodically. You can manage keys in your dashboard under Organization Settings → API Keys.
Create a dedicated key for each integration or service. This way, if a key is compromised, you can revoke it without affecting other integrations.

​
Authentication Errors

StatusErrorMeaning
401Missing X-API-KEY headerNo API key was provided in the request
401Invalid or revoked API keyThe key doesn’t exist or has been revoked