Gong connector setup

This connector reads Gong with an API key — an Access Key and its Access Key Secret — not with the "bring your own OAuth app" shape most pages beside this one describe, so there is no botseon oauth-app set step for it (see docs/connectors/README.md). Gong's OAuth path needs a Gong-granted developer instance, which is why this connector is not on it. Nobody at Botseon has run this connector against a live Gong account: it is built from Gong's published API description alone.

1. Create the key in Gong

Creating the key needs Gong's Tech admin role. A plain admin does not see the API page.

1. In Gong, open Admin center → Settings, and under Ecosystem click API.
2. Click Get API key. Give it a Key name; optionally set a TTL (days) after which it expires, and Trusted IPs — but leave that empty unless the deployment's outbound address is fixed, because a request from any other address is refused.
3. Copy the Access Key and the Access Key Secret now; Gong does not show the secret again. The connector takes the two as one value, <access key>:<access key secret>, and builds the Authorization: Basic header from it.

API access is available on any Gong plan; deleting the key in Gong revokes it at once.

2. The API base URL

Gong serves each company from its own API address, shown on the same API page. Set the plugin's Gong API base URL (api_host, PLUGIN_VARIABLES.gong, kind string) to exactly that — with or without https://. The documentation's example host is not every company's host, and the driver accepts only a host under gong.io.

3. What each tool does

Two of these reads are sent as POST — gong.get_call and gong.get_call_transcript — because that is how Gong's API takes a call filter; they change nothing.

Gong limits each company to 3 API calls a second and 10,000 a day, shared by every integration and key it runs. A member may notice a pause when a busy account reaches either.

4. Gong is on for every deployment

Gong's catalogue row (packages/db/seed/catalogue.json) ships available: true: every member sees the tile and can add it, with no operator setting. The old BOTSEON_GONG_CONNECTOR switch is gone; a deployment that still sets it changes nothing.

The catalogue's plugin-server import had laid a "coming soon" overlay on the Gong row, because the source's own hosted Gong server needs a sign-in app this build does not have. With the built-in connector on, that server is recorded as left out (built_in_connector_is_on, as Shopify's hosted server is, in scripts/plugin-server-tiles.inputs.json), so the tile reads Add, not Coming soon.

Nobody at Botseon has a Gong account, so the live smoke has still never run against Gong. The same smoke (the key check, then every read tool on the newest call) runs in PR CI against a simulated Gong tenant through the real driver (packages/connectors/src/gong-live-smoke.test.ts). Once an account with one recorded call exists, store GONG_TEST_KEY and GONG_TEST_API_HOST and run it (see docs/operations/connector-live-setup/gong.md and docs/operations/connector-test-accounts.md). If it fails, a member's Connect fails the same way and stores nothing (section 5), so no broken account is ever saved.

5. How a member connects

There is no operator step per member. On the Gong plugin's sheet the member:

1. fills in Gong API base URL (section 2);
2. pastes the key as <access key>:<access key secret> and ticks the four permissions (api:calls:read:basic, api:calls:read:extensive, api:calls:read:transcript, api:users:read). Gong's key carries no scopes of its own, so all four are true for every key; api:users:read is required because the check below reads users;
3. presses Connect. Botseon makes one request, GET /v2/users on that host with the Basic header, and stores the key sealed only if Gong answers 2xx. An unset or non-gong.io base URL is refused before any request, naming that field; a key Gong refuses (401, or 403 from outside the key's Trusted IPs) stores nothing. I updated the key (shown beside a tool marked as needing a permission) repeats the same request.

The connector stays read-only. Gong's API can also add calls, create meetings, change who may see a call, and erase a person's data; none of that is built, and the erase endpoints never appear in its source.

Where Gong stores a company's data — the US by default, or the EU — is chosen when the company signs up, and the choice shows up in its API base URL rather than in a separate documented EU host.