Security

Bootstrapware Onboard security

Narrow boundaries: publishable keys in the client, secret keys on the server, host-asserted user ids and workspaceKey, webhooks that carry operational ids (not host context), and an explicit Hosted progress exception.

Host asserts user id and workspace key. BYO keeps progress on your systems. Hosted stores step keys and timestamps you export.

Publishable vs secret keys

bsw_test_pub_ / bsw_live_pub_: browser-safe for config and Hosted widget calls.
bsw_test_sec_ / bsw_live_sec_: server only. Never ship in client bundles or NEXT_PUBLIC_ / VITE_ env vars. Mint authorToken and manage flows from your BFF.

Dashboard login uses a user session cookie, not a secret API key in the browser. Mint and revoke stay on the Keys page. Docs: API keys.

Host-asserted user.id and workspaceKey

Bootstrapware does not authenticate checklist end users. Your host asserts an opaque stable user.id and workspaceKey. Publishable key + forged ids can be abused if the key leaks. Mitigate with allowed origins and authorToken (mint with your secret key; enable requireAuthorToken on the flow). Treat client validation as UX, not a trust boundary.

Guide: host-asserted identity.

authorToken for live Hosted

Test publishable keys can write without a token. Live Hosted requires authorToken minted from your BFF session with your secret key. Bind flowId and workspaceKey when you mint. Default permissions: complete, skip, dismiss, snooze. Pass reset to show Reset my progress (personal scope only). The widget never mints or renews tokens — your BFF refreshes before expiry.

Origins and CORS

Browser calls to the Onboard API are subject to per-flow allowedOrigins on published config. Config, progress, and outcomes reject a disallowed Origin with HTTP 403. Production should list the exact origins that embed the widget. This is not a substitute for keeping secret keys off the client. See origins.

BYO vs Hosted data path

BYO: progress never touches Bootstrapware. Your adapter hits your API. Enforce authz from the signed-in session. Bootstrapware hosts published flow config only.
Hosted: progress records and integration-reported summaries (opaque ids, step keys, revisions, timestamps — not host context/flags) are stored on Bootstrapware. You own content decisions. Cancel Hosted: freeze writes immediately; JSON export for 30 days; then delete. Hosted → BYO keeps data; there is no 30-day clock.

MCP boundary

MCP configures flows only (list_flows, draft, publish, restore, get_install_snippet, …). Never send host context, flags, or progress payloads through MCP tools. Prefer OAuth Connect over putting secret keys in mcp.json.

Webhook signing

Deliveries POST JSON and sign the raw body with HMAC-SHA256. Verify header X-Bootstrapware-Signature (hex digest) using your endpoint secret. Payloads carry identifiers, not host context. See webhooks guide.

What Bootstrapware cannot access (BYO / local)

Host context, role, plan, and flags (they stay in the widget)
Progress records on BYO or local adapter
Your database
Your application session cookies (unless you send them yourself)
End-user passwords or OAuth tokens for your product login

API keys docs Privacy