Scope the connection
Local API keys support event-scoped registration.write, expiry and revocation. Real API keys stay on client servers.
Explore event-scoped REST contracts and a planned webhook delivery platform. Inspect a local sample event, failed attempt and replay without connecting a real endpoint.
Local backend slices exist · frontend integration and planned extensions remainLocal Node keys support registration.write. Real keys stay on your server. This console creates only non-secret fixture metadata.
Example endpoint: https://crm.example.test/hooks/gathrr. Signed outbound hooks, inbound callbacks, retries and a deployed sandbox remain planned.
| Attempt | Event ID | HTTP | Inspect |
|---|---|---|---|
| No sample attempts yet. | |||
Retries retain the same event ID for deduplication. The guide specifies bounded exponential backoff with jitter, at-least-once delivery and no global ordering guarantee.
Gathrr-Event-Id: evt_demo_001
Gathrr-Event-Type: checkin.decision.made.v1
Gathrr-Timestamp: [request timestamp]
Gathrr-Signature: v1=[redacted; not computed here]
Gathrr-Attempt: 1
{
"id": "evt_demo_001",
"type": "checkin.decision.made.v1",
"organization_id": "org_demo",
"event_id": "event_demo",
"occurred_at": "2026-10-21T09:30:00Z",
"data": {
"attendee_ref": "attendee_demo",
"decision": "allow",
"zone": "hall-a"
}
}Signature verification belongs on the client server: HMAC-SHA256(secret, timestamp + "." + raw_body), constant-time comparison and a five-minute timestamp window. This preview does not validate a signature or contact a provider.
Local API keys support event-scoped registration.write, expiry and revocation. Real API keys stay on client servers.
The guide specifies signed, versioned events with redacted references. Biometric material, ID values and credential secrets do not belong in webhooks.
A planned console covers delivery attempts, retries and replay. At-least-once delivery requires stable-ID deduplication and does not guarantee global ordering.
Existing local REST/key contracts and a planned delivery platform, with safe sample event flows.
Local Node contracts cover public event, venue, stall and registration slices; availability depends on the active gateway and deployment.
Local event-scoped keys support registration.write, one-time display, expiry and revocation. Real keys belong only on a client server.
The guide specifies HMAC-SHA256 over timestamp + period + raw body; no webhook dispatcher is claimed as deployed.
Authenticate provider callbacks, bind them to a job and handle duplicates. No arbitrary unsigned browser callback is trusted.
Stable event IDs, redacted attempts, bounded backoff and manual replay are planned; the new console is a local simulation.
The demo is browser-local, not a deployed sandbox. A real self-service integration sandbox is planned.
Read-only snapshots of implemented local key, registration and venue/stall contracts are provided; proposed interfaces remain labeled.
Use scoped REST and safe event outcomes for client systems; no named native CRM/ERP connector is claimed.
Read-only local backend contract snapshots. Deployment, authorization and frontend connection must be confirmed separately. Server keys stay on your server.
Signed webhooks, inbound callbacks, sandbox provisioning and delivery replay remain proposed workflows; these snapshots do not implement them.
No. The interactive event flow and delivery log are browser-local simulations. No request is sent to a CRM, ERP or arbitrary URL.
registration.write exists in the local Node key/registration slices. Broader credential, attendance, verification, navigation, device and webhook scopes remain proposed.
No. Server-to-server API keys belong on a client server. Attendee apps use an appropriate short-lived token design; the demo contains no real secret.
Start with event management. Shape what comes next.