Secure by default. Inspectable when it matters.
Eventlayer isolates customer resources, protects credentials and gives API operations the context needed to investigate problems.
Your resources stay inside your workspace.
Resource operations are scoped to their owning account. Public identifiers do not grant access without a valid credential for the same owner.
Workspace A
Credential A → resources in A
Other workspace credentials rejected
Workspace B
Credential B → resources in B
Other workspace credentials rejected
Create, rotate and revoke access.
Dashboard sessions use verified identities and short-lived signed access tokens. API integrations use named keys that can be created and rotated independently.
Signed on the way out.
Verify each webhook with the endpoint’s signing secret before processing it.
TypeScript · server
import { verifyWebhook } from "eventlayer";
const event = await verifyWebhook({
body: await request.text(),
headers: request.headers,
secret: process.env.EVENTLAYER_WEBHOOK_SECRET!,
});Secrets stay out of the response.
API keys are stored as hashes and webhook signing secrets are encrypted before storage. Apple signing credentials remain isolated from product APIs and are never returned to clients.
A clear security boundary.
Eventlayer handles
Resource isolation, credential storage, pass signing and webhook delivery signatures.
You handle
Your application, API key storage, staff access, webhook verification and the attendee data you collect.
Operational controls
Request limits, timeouts, rate limiting, structured errors, request identifiers, and telemetry help contain and investigate failures.
Found a security issue?
Send security reports to security@eventlayer.dev. Please include reproduction steps and avoid accessing data that is not yours.