Advanced (Pro Features)

Internal Public
📘 User Manual 19 views Updated 4 days, 23 hours ago

Advanced (Pro Features)

This tab contains advanced features for integrating Vora with your external systems. Some are gated to Growth, Pro, or Enterprise plans.

The API Key is available on every plan. It is what connects the Vora app for Shopify, and that
app works on the free plan. Calling the Vora API directly from your own code requires Pro, as do
the two write credentials on this tab (the Rewards HMAC Secret and the Idea Management API Key).

What is gated is integration, not the underlying feature:

  • Voter Rewards still works on every plan. The space admin redeems claims from the Vora
    dashboard as before. What is Pro-and-above is a storefront redeeming them server-to-server.
  • Idea challenges still work on Growth. You create, publish and review them in the dashboard as
    before. What is Pro-and-above is driving them from your own backend.

API Key

Shown on every plan. Use this key to connect the Vora app for Shopify
whatever plan you are on. Calling the API directly from your own code is a Pro
feature: on Starter and Growth a direct request is refused with
402 API_ACCESS_NOT_ON_PLAN, and the message tells you so.

View, copy, and regenerate your organization's API key. Use this key in the Authorization: Bearer <key> header when making API requests on behalf of your organisation - for example, importing members in bulk or pulling proposal results.

The API key is your brand-side server identity for Vora's API. Keep it secret. Rotating regenerates the key and invalidates the previous value immediately; coordinate with your backend before clicking Regenerate.

Rewards HMAC Secret

Pro plan and above. Rewards can still be redeemed by the space admin
from the dashboard on any plan; this secret is for automated, server-to-server
redemption, and a signed request from a Starter or Growth space is refused with
402 API_ACCESS_NOT_ON_PLAN.

The HMAC shared secret your external storefront uses to mark voting-code redemptions on Vora automatically (no admin login required). Pair this with the X-Redeemer / X-Timestamp / X-Signature headers documented in the Verifying & Redeeming Claims guide.

Generating your secret

  1. The panel is right below the API Key section
  2. Click Generate the first time - Vora creates a 64-character hex string (256 bits of entropy)
  3. Click Copy to copy the value to clipboard, then paste it into your storefront backend's secret store (AWS Secrets Manager, Vercel env vars, GitHub Actions secrets, etc.)

Your redeemer prefix

Right below the secret, the panel shows your redeemer prefix - this is your org slug. Your storefront's signed requests must use it in the X-Redeemer header:

X-Redeemer: <your-org-slug>-<any-identifier>

The suffix after the hyphen is free-form - use it as your own correlation id (e.g., acme-drop-001, acme-lambda-warm-12). Vora derives the secret to use from the prefix only.

Rotating

Click Regenerate to roll the secret. The new value is live immediately, and the previous value stops working on the very next signed request - coordinate the rollout with your backend so you don't strand any in-flight signed calls.

Warning

A leaked secret = anyone can mark your claims redeemed against the wrong customer. Treat it like a database password. Don't commit it to your repo; don't log it in your backend's request traces.

When to use it vs. the JWT path

  • Use HMAC when your commerce backend (Shopify, custom Lambda, Next.js API route, etc.) needs to mark claims redeemed during a checkout flow. No admin login required.
  • Use the admin JWT path (the existing Mark as Redeemed button on the verification page) for in-person redemption at venues, or for one-off manual flips.

Both paths are fully audited - Vora logs which method was used and which redeemer id authorised each redemption.

Custom Domain

Configure a custom domain for your governance space (e.g., governance.yourbrand.com):

  1. Enter your desired domain
  2. Click Save Domain
  3. Configure DNS records at your domain registrar:
  4. CNAME Record - Point your subdomain to Vora's servers (the exact target is displayed)
  5. TXT Record - Add a verification record to prove domain ownership (the name and value are displayed)
  6. Click Verify DNS Configuration
  7. Once verified, SSL is automatically provisioned within 15 to 45 minutes
  8. Your custom domain is live

The SSL status shows as:

  • Provisioning... - Certificate is being issued automatically
  • SSL Active - Your domain is fully live with HTTPS
  • SSL Error - There was an issue; the system will retry automatically

Webhooks

Receive real-time notifications when events happen in your space:

  1. Toggle Enable Webhooks on
  2. Enter your endpoint URL
  3. Select which events to receive:
  4. Vote Cast - When a customer votes
  5. Proposal Created - When a new proposal is created
  6. Proposal Status Changed - When a proposal's status changes
  7. Configure retry behaviour
  8. Click Test Webhook to verify your endpoint
  9. View delivery history to debug any issues

Plan Comparison

See a side-by-side comparison of your current plan limits versus the next available upgrade (Growth or Pro), with an upgrade button.

On This Page