Security basics for API keys, embed tokens, and webhooks

​

API keys (pe_api_…)

• Created under API & MCP (Workspace nav).
• Require both Authorization: Bearer … and X-PE-API-Key-Id.
• Tokens are shown once — store them in a secret manager or server environment.
• Prefer least privilege and separate keys per environment or agent.
• Revoke immediately if a key may have leaked; create a replacement.

​

My app / embed tokens

• Created under Integrations → My app.
• Restrict allowed origins to your real app hosts.
• Inject user fields from your backend into the embed snippet — do not let browsers invent trusted identity without your server.
• Rotate/revoke embed keys when rotating other production secrets.
• Keep portal pe_token links short-lived; do not log them in analytics if avoidable.

​

Webhooks

• Signing secrets look like pe_whsec_… and are shown once.
• Verify X-PE-Signature (HMAC-SHA256 of the raw body) before trusting a payload.
• Use HTTPS endpoints you control.

• Receive URLs contain a secret token (pe_in_…). Treat the full URL as a secret.
• Disable or delete unused inbound endpoints.
• Map only the fields you need; validate email/title in your sending tool when possible.

​

General practices

• Never commit secrets to git or paste them into public tickets.
• Limit who can open API & MCP, Integrations, and billing-sensitive Settings pages.
• After a teammate leaves, revoke keys they may have copied and review active webhooks.