1. Issue a session
Exchange a verified server-side identity for a short-lived widget token.
The widget opens quickly. Identity, permissions, and secrets stay on your server.
Exchange a verified server-side identity for a short-lived widget token.
Pass the application ID and token to the public beta React SDK.
Verify HMAC-signed webhooks before processing customer events.
Widget SDK
One asynchronous loader works on any website. React applications can optionally use @envelen/react. Authenticated products mint tokens on the server; anonymous sites use origin-bound visitor sessions.
<script
async
src="https://app.envelen.com/envelen.js"
data-app-id="app_public_id"
></script>API
Versioned `/v1` endpoints with scoped API keys and stable error envelopes.
Webhooks
HMAC signatures, bounded retries, durable attempts, and audit history.
MCP · not available
The server is not shipped yet. Use the public API and signed webhooks as the current integration surface.