Mreyti workspace · Getting connected

Your workspace, connected.

Register a website, configure its SDK integration and receive signed webhook events.

01Create your workspace

Sign up or log in using an email address and a password of at least 12 characters. Each account manages its own websites and webhook settings. This first version has no email verification, recovery email or SSO; use it for evaluation while deployment review is pending.

02Register and verify a website

  1. Register the exact HTTPS origin, including its subdomain: for example https://shop.example.com.
  2. Copy the displayed DNS TXT record into your domain provider. The record for that example is at _mreyti.shop.example.com; some providers expect the relative label _mreyti.shop.
  3. Wait for propagation, then press Check verification.
  4. Paste the generated script snippet into that website. It loads the current hosted SDK after checking the registered origin.

The website ID is public configuration, not a secret or a licence enforcement mechanism. The camera remains off until the shopper presses Start. To set your own catalogue, listen for mreyti-mounted on the target before the deferred loader runs, then call event.detail.element.setFrames(yourFrames) and set its sku. See frame setup.

Removing a website prevents future managed configuration loads. It cannot erase an SDK somebody already copied or stop an already running widget.

03Receive signed events

Save your public HTTPS endpoint in website settings. Copy the signing secret immediately: it is shown only when saved or rotated. Store it on your receiving server. Once the website is verified, press Send test event and inspect the delivery status.

Supported events are website.verified (when an endpoint already exists) and webhook.test. Their payload contains only an event ID, type, timestamp, website ID and origin. No camera images, face landmarks, measurements or shopper usage events are sent.

Verify the exact raw request body before parsing JSON:

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyMreytiWebhook(rawBody, headers, secret) {
  const timestamp = headers['mreyti-timestamp']
  const signature = headers['mreyti-signature']
  if (typeof timestamp !== 'string' || !/^\d{10}$/.test(timestamp)) return false
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false
  if (typeof signature !== 'string' || !/^v1=[a-f0-9]{64}$/.test(signature)) return false
  const expected = createHmac('sha256', secret)
    .update(timestamp + '.').update(rawBody).digest()
  return timingSafeEqual(expected, Buffer.from(signature.slice(3), 'hex'))
}

Deduplicate the payload's event id durably. Return 2xx for accepted or already processed events. Mreyti attempts delivery up to five times, retrying after 60, 120, 240 and 480 seconds. It does not follow redirects and rejects private or special-purpose network destinations. Delivery history is kept for 30 days.

Disabling a webhook cancels queued deliveries; an in-flight request may finish. When rotating the secret, allow for in-flight events signed with the previous one.

04Explore avatar try-on

Open Avatar studio to generate a generic 3D character, change the sample frame, rotate the view and download a PNG. Generation runs locally and does not use a camera, uploaded photo or external image service. The character is not a personal likeness and cannot confirm physical fit.

Clothing try-on

In the dashboard, open Clothing try-on and choose your website. Import a product image, name, SKU, category and optional price/description. Select a product, upload a photo, read the Aigen notice and press Generate my look. Download the result as an AI style preview; it does not confirm physical fit.

Verify your website and enable public shopper previews to obtain a shareable collection link for your store. Public previews default off. Aigen may retain uploaded references and generated images; Mreyti does not store personal photos/results. This flow uses uploaded files and is separate from the local webcam mirror.

The API needs server-only AIGEN_URL, AIGEN_KEY and optionally AIGEN_PROVIDER (vertex). Restart the development API after configuring its gitignored .env, or rebuild both Compose services for production. Do not put project keys in client code. Daily attempt limits apply: 10 per merchant, 5 per shopper IP, 20 per website and 50 across the server. Failed attempts count; generation is never retried automatically.

05Run the account service

The dashboard requires the Node account API. For local development, first build the SDK, then start the API and Vite in separate terminals:

npm run build:lib
PUBLIC_ORIGIN=http://127.0.0.1:3002 npm run dev:api
npm run dev -- --host 127.0.0.1

Set PUBLIC_ORIGIN to the exact URL and port printed by Vite. The default proxy points to API port 3004. Local accounts and the encryption key are stored in the gitignored .data/ directory.

For deployment, use compose.yaml with a persistent database volume, an HTTPS public origin and a stable 64-character hex MREYTI_SECRET_KEY in the server's secret manager. Generate a key with openssl rand -hex 32. Keep it separate from the database backup and never expose it to browsers. Start the two-service stack with docker compose up --build -d.

The old static-only container does not provide login or SDK configuration routes. The operator must deploy the API alongside nginx. Run one API instance; this SQLite-backed version is not designed for horizontal scaling. The existing full-runtime size gate still blocks automated releases.

Analytics & credit

Open Analytics & credit to see your clothing requests by website and the last 7, 30 or 90 UTC calendar days. Review generated looks, failures, recorded charges, average generation time, daily charts, top products and recent results. Tracking begins with this update; earlier Aigen usage cannot be assigned to products. Unknown charges are disclosed rather than counted as free.

Configured billing operators also see the shared Aigen project's live credit, current image price and estimated images remaining: floor(balance divided by image price). These project totals include every app using the key. The balance is cached for 60 seconds and stale values are labeled. Actual Aigen charges already include markup. No separate merchant wallets are created.

To enable shared credit viewing, set server-only MREYTI_BILLING_VIEWER_IDS to the verified operator account's stable user ID from the deployed database (comma-separated for multiple accounts). The default grants nobody access; unverified email addresses cannot grant this permission. Each merchant can always view their own usage. Analytics stores request metadata, never shopper photos or biometric measurements.