Security checklist

Protect Model A embeds and Model B access to your Eventyvo data.

Applies to both website models. Model B items are required before production sync.

Model A — features on your site (embeds / subwebsite)

• No ev_live_* / ev_test_* in HTML, CMS fields, or frontend bundles
• Embeds use https://docs.eventyvo.com only (Connect widgets)
• CSP allows docs host for script-src / frame-src — CSP guide
• Only published events / public catalog for your company are embedded
• Registration and payment stay on Eventyvo-hosted flows (CTA / subwebsite)

Model B — related Eventyvo data in your stack

• Store ev_live_* keys in server env vars / secrets manager only
• Never commit keys to git or expose in frontend bundles
• Rotate keys on every buy/renew — update deployment promptly
• Treat the key as tenant-scoped: it unlocks your company data only — do not share across vendors without a contract
• Verify webhook HMAC signatures (X-Eventyvo-Signature, X-Eventyvo-Timestamp) on the raw body
• Use embeds for public pages; reserve Connect REST for your backend / Zapier vault
• Handle 429 THROTTLED with exponential backoff and Retry-After
• Cache public widget data 5–10 min; never cache webhook bodies as durable truth
• Restrict webhook endpoint to HTTPS with valid TLS; make handlers idempotent
• Minimize PII in logs — Data & privacy
• Monitor quota alerts at 80% / 100%

Warning: Never document or use platform internal API keys. Integrators use their own Connect keys only. Organizer GraphQL is not a public partner API.