Security & privacy
Security & privacy
How API keys are scoped, what shopper data actually gets sent to Solary, and how new loyalty members are created safely.
API keys
Each company has one active API key at a time. It's sent as the X-API-Key header and is the only thing that authenticates a request to the events endpoint. There is no separate public/secret key pair, the key is always a secret.
- Revoking a key immediately rejects any request using it with a 401.
- A company can only have one active key, generating a new one revokes the previous one.
- Keys are scoped to a company: every event created with a key is attributed to that company only.
Keep it server-side
What data is sent
Tracking an event only requires the shopper's email, and optionally a first and last name if you want a friendlier name on a newly created account. No password, payment information, or platform-specific customer id is ever sent to Solary.
| Field | Sent to Solary? |
|---|---|
| Yes, used to identify or create the user. | |
| First / last name | Optional, only used when creating a new user. |
| Order total / points | Yes, as the pointsEarned value you calculate. |
| Password, payment details | Never. |
How new users are created
When an event arrives for an email with no matching Solary user, one is created and linked to your company automatically, no signup form or password required. This keeps the integration fully automated: a shopper can earn points on their very first purchase without ever creating a Solary account by hand.
Questions
For anything not covered here, reach out to your Solary contact before sending production traffic through a new integration.