Build on EntryWick

Registration, tickets and check-in, through the same API the EntryWick admin uses.

Getting a key

An organizer opens Organization → API keys in their EntryWick admin and makes one. Choose Test to build and rehearse: a test key reaches the same endpoints, and what it scans is kept out of everything live. The key is shown once.

Send it as a bearer token to https://api.staging.entrywick.com/v1. The key names the organization, so there is none in the address.

The sandbox

An organization of made-up people, refreshed every night. Its key is public and reaches nothing real:

ewk_test_663b4035dc483a582e20e92d6f7df59c4ee5e77a

What is in it right now — the event's id, its day and type codes, and a call you can paste into a terminal.

Checking your scanner against ours

The check-in decision is held to a set of golden cases, and so is our own scanner: download them and run your hardware through them. Result codes must match; the words you show a person are yours.

Limits

Reading needs the Growth plan or above; changing anything, Scale.
Each key has its own requests per minute, never above the plan's; every answer carries X-RateLimit-Limit and X-RateLimit-Remaining.
Calls are counted per calendar month. Past 150 % of the plan's allowance they are refused until the 1st.
Every POST needs an Idempotency-Key; a retry with the same key gets the first answer for 24 hours.

Webhook signatures

Every delivery carries EntryWick-Signature: t=…,v1=…, the hex HMAC-SHA256 of {t}.{raw body} with the endpoint's secret. Recompute it over the body exactly as it arrived, compare it in constant time with each v1 (for a day after a secret is rotated there are two), and refuse a t more than 300 seconds from your clock.

Check your code against these vectors: each must verify with its secret, and fail with the body changed by a byte.

one secret

secret: whsec_4f1c2b7e9a3d5c8b0e6f1a2d3c4b5a69788796a5b4c3d2e1f0a9b8c7d6e5f4a3
t:      1725543730
body:   {"id":"evt_01J7Q3M4R7X8Y9ZABCDEFGHJKM","type":"checkin.recorded","api_version":"2026-09-01","created_at":"2026-09-05T13:42:10Z","livemode":true,"data":{"id":"01j7q3m4r7x8y9zabcdefghjkm","result":"accepted"}}
header: t=1725543730,v1=5c785b2a8abda36ee270ae47c59d1d6f654c607d3edc89e031b3adcf0e704e2f

during a rotation: the new secret first, then the old one

secret: whsec_4f1c2b7e9a3d5c8b0e6f1a2d3c4b5a69788796a5b4c3d2e1f0a9b8c7d6e5f4a3
secret: whsec_0a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef
t:      1725547330
body:   {"id":"evt_01J7Q3M4R7X8Y9ZABCDEFGHJKN","type":"registration.created","api_version":"2026-09-01","livemode":true,"data":{"id":"01j7q3m4r7x8y9zabcdefghjkn","status":"confirmed"}}
header: t=1725547330,v1=7c168eff60c05d1168f7908a74c32b1edd0448fe1e1bdb7a3cc423a2bdbb5b18,v1=1faae2027103827c45f4560dc8ab38de0539ea46e996e1be4ea30b10c1c99c37

an empty object and non-ASCII text are signed byte for byte

secret: whsec_4f1c2b7e9a3d5c8b0e6f1a2d3c4b5a69788796a5b4c3d2e1f0a9b8c7d6e5f4a3
t:      1725550930
body:   {"id":"evt_01J7Q3M4R7X8Y9ZABCDEFGHJKP","type":"registration.updated","livemode":false,"data":{"answers":{},"name":"Zoë Ağa"}}
header: t=1725550930,v1=94ca86824db4db99ab0a547b5feabc4d9a072efe80be0335e811a0808c60eafd

Zapier and Make

EntryWick's Zapier and Make apps are built on this API and nothing else. A Zap starts from a webhook (subscribing makes an endpoint with POST /webhooks, unsubscribing deletes it), and each action is one of the operations in the reference.

The apps name themselves on every call with X-EntryWick-Client: zapier (or make). A request that sends the header needs the Growth plan or higher, and the name is kept in the organization's audit log. Leave the header out of your own integrations.

Growth: every trigger, and Find registration.
Scale: Create registration and Issue ticket (API writes), and Record check-in (scanning with a key).