security
Keep account, workspace, event, guest, and payment access separate.
Ajoyo validates request data, authenticates protected routes, scopes tenant resources, signs provider webhooks, and returns safe API errors without exposing internal exceptions.
Why it matters
The problem we built
this to solve.
A valid account should not automatically grant access to every workspace or event.
Provider callbacks and guest credentials must be verified before they change money or attendance state.
What's included
Every capability, end to end.
arrow_right
Password and session authentication
arrow_right
Passkey and social-provider flows
arrow_right
Structured 422 validation errors
arrow_right
Webhook HMAC verification
arrow_right
Security headers and CORS controls
FAQ
Things owners ask us.
Does Ajoyo store biometric images?
No. Passkeys keep biometric verification on the user’s device; the server stores public-key credential data.
Are raw server errors returned to users?
No. Unexpected errors are logged internally and the API returns a safe error envelope.
See secure event platform in action.
Start a 30-day trial — all features unlocked. No credit card. Cancel anytime.
Built by Bowofade Oyerinde · Powered by Bonifade Technologies.