Security

Bootstrapware Comments security

Publishable keys identify the workspace. Secret keys mint access on your server. Webhooks carry operational ids. Hosted discussion text is the explicit storage exception.

Comments demo for the task Approve the launch checklist, with You selected, an unread discussion, and load more.

Publishable vs secret keys

bsw_test_pub_ / bsw_live_pub_: browser-safe for config and Hosted widget calls.
bsw_test_sec_ / bsw_live_sec_: server only. Never ship them in client bundles or NEXT_PUBLIC_ / VITE_ env vars.

Dashboard login uses a user session cookie, not a secret API key in the browser. Mint and revoke stay on the Keys page. Docs: API keys.

Author tokens

A publishable key and allowedOrigins do not prove the end user may read or write. Your server checks membership, then calls POST /api/v1/author-tokens with the secret key. The token is bound to workspace, environment, app, tenant, resource type, resource id, and an explicit permission list. Default lifetime is 300 seconds. Live calls to the Comments API require that token. A test app can leave it optional until requireAuthorToken is on. Do not accept a client-supplied user id or permission list as the grant. BYO content calls stay on your API, authorized by your session.

Guide: resource authorization.

Origins and CORS

Browser calls are subject to per-app allowedOrigins on published config. Production should list the exact origins that embed the widget. Origins are not a substitute for the author token. See origins.

BYO vs Hosted data path

BYO: discussion text never touches Bootstrapware. Your adapter hits your API. Enforce authorization from the signed-in session.
Hosted: bodies and mention ids are stored on Bootstrapware. You moderate. Cancel Hosted: freeze writes immediately; export for 30 days; then delete.

MCP boundary

MCP configures apps, including list_comment_apps, create_comment_app, publish_comment_app, ensure_comment_test_publishable, and get_comment_install_snippet. The full tool list is on the agents page. It does not accept comment bodies. Prefer OAuth Connect over putting secret keys in mcp.json.

Webhook signing

Hosted deliveries POST JSON and sign the raw body with HMAC-SHA256. Verify X-Bootstrapware-Signature with your endpoint secret. Payloads carry identifiers, not bodies. See webhooks.

What Bootstrapware cannot access (BYO / local)

Comment bodies and mention payloads on BYO or the local adapter
Your database
Your application session cookies, unless you send them yourself
End-user passwords or OAuth tokens for your product login

API keys docs Privacy