- 01
Grant the minimum scopes
Administrators create named, expiring keys with separate read and write scopes. The secret appears once; the key creator remains the service actor and current effective permissions still apply.
- 02
Use the bounded API
The v1 API lists and reads tasks, announcements, meetings, and active documented member fields. It creates and updates tasks, announcements, and meetings and has a dedicated task-completion operation; it does not delete records or administer members, billing, providers, keys, or webhooks.
- 03
Verify outbound events
Allowlisted task, announcement, and meeting events from API mutations are signed over the exact raw body. Receivers should verify the HMAC before parsing and deduplicate by event ID.
- 04
Inspect delivery outcomes
RelayBoard retries failed deliveries with bounded backoff, disables an endpoint after repeated failures, and provides a redacted log plus bounded replay. Destinations must be public HTTPS and redirects are rejected.
Related guides