One browser session. Scoped credentials for systems.

Browser products

Chat, Forge, Apex, and API-key management use the Eventium API-owned session. The session cookie is Secure, HttpOnly, and unavailable to JavaScript. State-changing browser requests include the CSRF token returned by GET /api/auth/session.

const response = await fetch("https://api.eventium.ai/api/auth/session", { credentials: "include" });
const session = await response.json();

Google sign-in begins at /api/auth/oauth/google/start with an allowlisted surface and relative return_to. Eventium validates both before redirecting.

Server and MCP clients

Create a dedicated, revocable API key for each app or environment. Send it in X-Api-Key. Keep keys in a secret manager and never place them in browser storage, source code, query strings, or generated artifacts.

curl https://api.eventium.ai/api/health -H "X-Api-Key: $EVENTIUM_API_KEY"

Authorization after sign-in

Identity does not grant access by itself. The API checks entitlement, tenant or workspace membership, project scope, role, and capability for the requested operation.

Manage API keys
Create, name, and revoke scoped keys.Test a request
Credentials remain in the current tab.