Skip to content

VWO API Key

Service Name: Visual Website Optimizer (VWO)

Service Description: VWO is an A/B testing and conversion optimization platform that enables businesses to test, analyze, and optimize their websites and apps to improve user experience and increase conversions.

Service Address: https://vwo.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through VWO's security settings

Secret Access Scope: Grants programmatic access to VWO's API for managing A/B tests, campaigns, goals, variations, and retrieving analytics data.

Secret Revokement URL: https://app.vwo.com/#/settings/account/developers

Secret Example: 7a8b9c0d-1e2f-3g4h-5i6j-7k8l9m0n1o2p

Suspicious Activity Investigation Instructions:

  • Review the VWO account activity logs for unauthorized campaign changes or test creations
  • Check for unexpected variations being created or modified in your A/B tests
  • Monitor for unusual API calls or data access patterns from unfamiliar IP addresses
  • Verify if there are any unexpected changes to conversion goals or tracking settings
  • Look for unauthorized user accounts that may have been added to your VWO account

Mitigation Instructions:

  • Log in to your VWO account and navigate to Account Settings > Developers
  • Locate the compromised API key and click "Revoke" to immediately invalidate it
  • Generate a new API key if needed for legitimate applications
  • Review and update access permissions for all users with access to the VWO

account

  • Enable two-factor authentication for all users with access to the VWO

dashboard

  • Update any application code or integrations to use the new API key
  • Consider implementing IP restrictions for API access if available in your plan