Authentication

Where keys are created

API keys are created in WODira under Organization profile → API. You must sign in as an organizer or as a member with permission to manage the organization.

1. Open WODira and enter your organization dashboard.
2. Go to Organization profile.
3. Open the API tab. You can also use a route such as /organizer/{organizationId}/profile?tab=api.
4. In New key, choose Secret key (backend) or Publishable key (frontend).
5. Configure the name, scopes or allowed origins, then click Create key.
6. Copy the full key when it appears. For security, it will not be shown again.

After creation, WODira only shows the prefix/last characters, type, permissions, last use, and actions such as revoke.

Secret keys

Secret keys start with wd_live_... and are sent from backends:

curl -H "Authorization: Bearer wd_live_..." \
  https://api.wodira.app/external/v1/organizer/events/search

x-api-key is also accepted.

Publishable keys

Publishable keys start with wpk_live_... and are sent from browsers:

x-publishable-key: wpk_live_...
Origin: https://organizer.com

The backend requires Origin to match one of the key’s allowedOrigins.

Rules

• Never expose a secret key in public JavaScript.
• Publishable keys only work with browser endpoints.
• successUrl and cancelUrl must belong to an allowed origin.
• Revoked or expired keys stop authenticating immediately.