navieo

API & Authentication

Navieo uses app-scoped API keys. A publishable key (nv_pub_...) is intended for browser SDK requests; a secret key (nv_secret_...) is reserved for trusted server-side write operations. Never expose a secret key in browser code, documentation, screenshots, logs, or a public repository.

Release compatibility

As of September 28, 2026, the published packages are React 3.0.0, Core 2.0.0 and Types 3.0.0. Install @navieo/react; it includes its compatible Core and Types dependencies. This release supports widget configuration and saved authored tours through playTour(slug) or suggestions with tourSlug.

These versions also support free-form assistant questions and live guidance against the compatible live-first backend. Older React 1.9.0 / Core 0.5.0 packages use a retired assistant transport and must be upgraded. Use the SDK rather than calling assistant endpoints directly.

Live guidance and privacy

The guidance release uses the current page to find available controls and the scanned sitemap to understand destinations. Google selects among permitted controls; users perform actions and Navieo checks progress. Guidance is enabled by default, with an informational-only opt-out. See Provider Setup for the options.

For V1, disabling guidance can take up to five minutes to reach other server workers. This is not immediate access revocation. Live-label consent is checked separately on page requests and fails off when unavailable. See Live Guidance & Privacy for the full timing and data boundaries.

Publishable key setup

Get the publishable key from the app's Settings page and provide it through your framework's public environment configuration:

NEXT_PUBLIC_NAVIEO_PUBLISHABLE_KEY=nv_pub_your_key_here

For non-Next.js frameworks, pass publishableKey directly or expose the value through the bundler's documented public environment mechanism. Publishable keys identify an app and are rate-limited, but they are not user-authentication or authorization credentials. The host application remains responsible for both.

Security boundary

  • Every backend request resolves the app from the presented key.
  • Dashboard mutations require authenticated organization/app access rather than a publishable key.
  • Secret keys are server-side credentials and must be rotated if disclosed.
  • Navieo does not use host authentication credentials or roles as guidance authority. Do not pass passwords, session cookies or access tokens to the SDK.
  • If you supply the optional userId, the SDK sends it for authored-tour event attribution and impression lookup. Prefer an opaque identifier, not an email address or other sensitive personal data. It is not proof of authentication or permission.