Gorgias plugin

Use Gorgias through Corsair: one client, typed API calls. This plugin uses Gorgias private-app API-key authentication. Store the API key as the account API key, the agent email in the account email field, and the account subdomain in tenant_external_id (the hostname prefix from your Gorgias URL). Requests use HTTP Basic authentication with email as username and API key as password. Public Gorgias apps require OAuth 2.0. This plugin intentionally supports private apps only; it does not provide the public-app authorization, scope-consent, or token lifecycle flow. Do not use a private API key for a public app. Account subdomains are tenant-specific and are validated as a single hostname label before request construction. No webhook receiver is included. Cursor pagination uses the provider cursor and limit parameters and returns the documented next/previous cursors. Gorgias documents API-key rate limits of 40 requests per 20 seconds (enterprise accounts use a 10-second window); the shared transport honors Retry-After on HTTP 429 responses. File downloads follow the provider redirect internally and return bounded base64 data; signed URLs and file contents are not logged. The client enforces a 20 MiB local safety limit for file transfer. The deprecated ticket-message listing route remains available because Gorgias still lists it in its REST reference; prefer ticketMessages.listMessages for new work. What you get:

114 typed API operations

Setup

Install

npm install corsair @corsair-dev/gorgias better-sqlite3
npm install --save-dev @types/better-sqlite3

yarn add corsair @corsair-dev/gorgias better-sqlite3
yarn add --dev @types/better-sqlite3

pnpm install corsair @corsair-dev/gorgias better-sqlite3
pnpm install --save-dev @types/better-sqlite3

bun add corsair @corsair-dev/gorgias better-sqlite3
bun add --dev @types/better-sqlite3

Add the plugin

corsair.ts

import Database from 'better-sqlite3';
import { createCorsair } from 'corsair';
import { gorgias } from '@corsair-dev/gorgias';

export const corsair = createCorsair({
	plugins: [
		gorgias(),
	],
	database: new Database('corsair.db'),
	kek: process.env.CORSAIR_KEK!,
	multiTenancy: true,
	hub: {
		projectApiKey: process.env.CORSAIR_API_KEY!,
		signingSecret: process.env.CORSAIR_SIGNING_SECRET!,
	},
});

With multiTenancy: true, scope calls with corsair.withTenant(id). See Quick start for KEK + Hub keys, and Multi-tenancy for account isolation.

Choose authentication

API Key (Recommended)

Store the Gorgias API key before the first call: pnpm corsair setup --plugin=gorgias --tenant=acme api_key=<your-key> (leave out --tenant without multiTenancy), or pass it as key in the plugin options. With Hub, each tenant enters their own key on the connect page. See API key auth.

gorgias()

More: API Key

Connect a tenant

Mint a connect link and send the tenant to it. Hub hosts the page and delivers the result to your app — see Connect / OAuth.

const { connectUrl } = await corsair.manage.connect.createLink({
	plugin: 'gorgias',
	tenantId: 'acme',
});
// redirect the user's browser to connectUrl

Example API calls

account.getAccount

const tenant = corsair.withTenant('acme');
await tenant.gorgias.api.account.getAccount({});

account.createAccountSetting

const tenant = corsair.withTenant('acme');
await tenant.gorgias.api.account.createAccountSetting({});

See the full list on the API page.

What’s next

API reference

Every gorgias.api.* operation with input and output types.

Connect / OAuth

createLink, Hub delivery, and tenant connect flows.

Use with agents

Expose this plugin’s operations as MCP tools.

Overview

Plugins