Skip to main content
An API key lets your servers call the Yativo API without signing in. It’s a pair of values sent as headers on every request: See Authentication for how to send them.

​
Keys and your team

  • Keys belong to your business, not to a person. A key keeps working if the teammate who created it leaves.
  • Keys act as your business account. Anyone holding a key and secret can use the API on your behalf, so give the permission to create keys only to people you trust with that access.
  • Keys don’t expire. They work until someone on your team revokes them.
  • Keys are for servers only. Never put one in a browser, mobile app or public repository.

​
Who can manage keys

The account owner can change which roles have these permissions on the Team page.

​
Create a key

1

Open API Keys

Sign in to app.yativo.com and go to Developers → API Keys.
2

Generate a key

Click Generate key.
3

Add a label and allowed IPs

Enter a Label so your team can tell keys apart, and the public IPs of the servers that will use the key. At least one IP is required. See IP whitelisting.
4

Save the secret

Copy the API secret into your secrets manager before closing the window. It can’t be shown again.
Create one key per system (for example “Production backend” and “Reporting job”). You can then revoke one without affecting the others.

​
Change a key’s allowed IPs

In Developers → API Keys, click Edit IPs on the key. The list you save replaces the current one. The key and secret don’t change, so there’s nothing to redeploy. When moving to a new server, add the new IP first, deploy, then remove the old one.

​
Rotate a key

1

Create a new key

Create a new key with the same allowed IPs.
2

Deploy it

Deploy the new key and secret to your servers.
3

Confirm traffic has moved

Check that the old key’s Last used time has stopped changing.
4

Revoke the old key

Revoke the old key in the dashboard.

​
Revoke a key

In Developers → API Keys, click Revoke on the key. It stops working immediately and can’t be restored.
If a secret may have leaked, revoke the key straight away, then create a new one.

​
Legacy API keys

The Account ID and App Secret shown under Legacy API keys on the same page are deprecated. From 15 October 2026 they stop working for requests from your servers. Move to the API keys above: see Migrate from legacy API keys.

​
FAQ

No. Only a hash of the secret is stored. Create a new key, deploy it, then revoke the old one.
No. From 15 October 2026, API keys and IP whitelists can only be managed in the dashboard.
No. Keys belong to the business. Teammates sign in to the dashboard with their own email code or passkey.
No. Each environment has its own keys. Create a separate key in each one.