Skip to main content

Personal Access Token (PAT) access

Besides the organization's API keys, the API now accepts Personal Access Tokens (PATs): personal keys that grant access with the permissions of the user who owns them.

The two credentials differ in scope:

  • Organization API key: associated with the organization, it grants access to the organization's portfolios and resources.
  • PAT: associated with a user, it carries that user's permissions. Requests authenticated with a PAT only see the portfolios and resources the user has access to.

A PAT is generated by the user in the Gorila platform, not through the API. It is sent the same way as an API key, in the Authorization header, and can be recognized by the pat_ prefix:

curl --request GET \
  --url https://core.gorila.com.br/portfolios \
  --header 'Authorization: pat_<token>'

Learn more about API keys in Organization.