Onboarding & credentials

Eventista issues these to you over a secure channel. They are not self-service.

Item	Header / use	Notes
apiKeyId	X-Api-Key header	Public identifier, e.g. pk_9a4a6b42c411ac48d20d7693.
secret	HMAC signing key	Secret. Shown once. Store it in a server-side vault. Never ship it to a browser or mobile app.
Base URL	request host	A sandbox and a production base URL.
allowedTenants	tenantId in body	The tenant ids you may award into.
Caps	enforced	perTx, perPartnerDay, perUserDay — in credited EP.

Base URLs

Environment	Base URL	Purpose
Sandbox	https://voting-dev.eventista.vn/voting/api	Integration & testing. No real EP value.
Production	issued at onboarding	Live EP. Confirmed with you directly.

Secrets are server-side only

The signature proves the request came from you. Anyone holding the secret can credit EP. Keep it in backend config / a secret manager, send requests server-to-server over HTTPS, and rotate immediately if it is ever exposed (see Secret rotation).