[EvilDavid75]

Hi StavrosK, you're right to be worried. We had someone playing with the API this week and sending wrong events. Security wasn't a primary concern for us, we started this as an internal joke (first version didn't even have a token system). Just to be clear, the light switch doesn't trigger a real light, but the way we handle sending sending the events from the browser is pretty dirty :)

[StavrosK]

Yep, you need at least a shared secret that isn't published anywhere for sending the events (reading them is fine if you're public).