Advanced (Pro Features)

This tab contains advanced features for integrating Vora with your external systems. Some are gated to Growth, Pro, or Enterprise plans - others (like the Rewards HMAC Secret) are available on every plan because they're required to use Voter Rewards properly.

API Key

View, copy, and regenerate your organization's API key. Use this key in the Authorization: Bearer <key> header when making API requests on behalf of your organisation - for example, importing members in bulk or pulling proposal results.

The API key is your brand-side server identity for Vora's API. Keep it secret. Rotating regenerates the key and invalidates the previous value immediately; coordinate with your backend before clicking Regenerate.

Rewards HMAC Secret

The HMAC shared secret your external storefront uses to mark voting-code redemptions on Vora automatically (no admin login required). Pair this with the X-Redeemer / X-Timestamp / X-Signature headers documented in the Verifying & Redeeming Claims guide.

Generating your secret

1. The panel is right below the API Key section
2. Click Generate the first time - Vora creates a 64-character hex string (256 bits of entropy)
3. Click Copy to copy the value to clipboard, then paste it into your storefront backend's secret store (AWS Secrets Manager, Vercel env vars, GitHub Actions secrets, etc.)

Your redeemer prefix

Right below the secret, the panel shows your redeemer prefix - this is your org slug. Your storefront's signed requests must use it in the X-Redeemer header:

X-Redeemer: <your-org-slug>-<any-identifier>

The suffix after the hyphen is free-form - use it as your own correlation id (e.g., acme-drop-001, acme-lambda-warm-12). Vora derives the secret to use from the prefix only.

Rotating

Click Regenerate to roll the secret. The new value is live immediately, and the previous value stops working on the very next signed request - coordinate the rollout with your backend so you don't strand any in-flight signed calls.

Warning

A leaked secret = anyone can mark your claims redeemed against the wrong customer. Treat it like a database password. Don't commit it to your repo; don't log it in your backend's request traces.

When to use it vs. the JWT path

• Use HMAC when your commerce backend (Shopify, custom Lambda, Next.js API route, etc.) needs to mark claims redeemed during a checkout flow. No admin login required.
• Use the admin JWT path (the existing Mark as Redeemed button on the verification page) for in-person redemption at venues, or for one-off manual flips.

Both paths are fully audited - Vora logs which method was used and which redeemer id authorised each redemption.

Custom Domain

Configure a custom domain for your governance space (e.g., governance.yourbrand.com):

1. Enter your desired domain
2. Click Save Domain
3. Configure DNS records at your domain registrar:
4. CNAME Record - Point your subdomain to Vora's servers (the exact target is displayed)
5. TXT Record - Add a verification record to prove domain ownership (the name and value are displayed)
6. Click Verify DNS Configuration
7. Once verified, SSL is automatically provisioned within 15 to 45 minutes
8. Your custom domain is live

The SSL status shows as:

• Provisioning... - Certificate is being issued automatically
• SSL Active - Your domain is fully live with HTTPS
• SSL Error - There was an issue; the system will retry automatically

Webhooks

Receive real-time notifications when events happen in your space:

1. Toggle Enable Webhooks on
2. Enter your endpoint URL
3. Select which events to receive:
4. Vote Cast - When a customer votes
5. Proposal Created - When a new proposal is created
6. Proposal Status Changed - When a proposal's status changes
7. Configure retry behaviour
8. Click Test Webhook to verify your endpoint
9. View delivery history to debug any issues

Plan Comparison

See a side-by-side comparison of your current plan limits versus the next available upgrade (Growth or Pro), with an upgrade button.