Skip to main content
Orgo provides a comprehensive REST API for integrating with external systems. Access member data, manage events, process payments, and automate workflows programmatically. API tokens management page showing active and revoked tokens

​
How to access

Settings → Developers → API Access Full API documentation: API Reference

​
Prerequisites

  • Administrator access required
  • API access must be enabled for your organization

​
API Authentication

​
API Keys

Generate API keys for server-to-server integration:
1

Navigate to API Settings

Go to Settings → Developers → API Access.
2

Generate API Key

Click Generate New API Key.
3

Copy and secure

Copy the key immediately. It won’t be shown again.
4

Set permissions

Configure what the key can access.

​
Using API Keys

Include in request headers:

​
API Endpoints

Common endpoints: See API Reference for complete documentation.

​
Rate Limits

API requests are rate-limited: Exceeding limits returns 429 Too Many Requests.

​
Webhooks

Receive real-time notifications when events occur:

​
Setting Up Webhooks

  1. Go to Settings → Developers → Webhooks
  2. Click Add Webhook
  3. Enter your endpoint URL
  4. Select events to subscribe to
  5. Save
Webhook creation form with event type selection

​
Webhook Events

​
Webhook Payload

​
Security

​
Best Practices

Never expose API keys in client-side code or public repositories.
All API requests must use HTTPS.
Generate new keys periodically and revoke old ones.
Grant only the permissions each integration needs.

​
Common Integrations

Sync member data with Salesforce, HubSpot, or other CRMs.
Keep Mailchimp, Sendinblue, or other email lists updated.
Export payment data to QuickBooks or Xero.
Build internal reporting tools with your data.

​
Limiting what a token can reach

A token does not have to carry everything you can do. Tokens are scoped by category, so you can give an integration access to members without giving it access to money. Categories Levels. Each granted category is either read or write. A category you do not grant is not reachable at all.
This is the answer to “can we let a developer or an external tool work with our member data without exposing payments?” Yes. Create a token granting members and leave financial out.
A scoped token can never exceed the permissions of the person who created it. The scope narrows that person’s access; it does not widen it. So a token created by someone without financial permissions cannot reach financial data even if the category is granted. Tokens can also be marked read-only across every granted category, and given an expiry date. For an integration that only reads, use both: the blast radius of a leaked token then stops at data it could already see, and stops entirely on the expiry date.

​
Getting Help

  • Orgo MCP - Connect AI assistants to your Orgo data
  • OAuth - OAuth authentication
  • Webhooks - Real-time notifications