Vatio holds only the public half of your signing key, so it can verify a token and never mint one. Everything dangerous about that arrangement is therefore on your side: this gem signs the token for the widget and verifies the same token back on your own API. `require "vatio/server"` adds the opt-in client for the server API -- having the agent write to a contact first on WhatsApp -- and the receiver for its signed webhooks, on Net::HTTP and nothing else.