Skip to main content
Legacy API keys (Account ID and App Secret) are deprecated. From 15 October 2026, tokens from POST /auth/login only work inside the Yativo dashboard, and requests from your servers must use an API key. See Migrate from legacy API keys.
Your servers authenticate with an API key: a key and secret pair sent as headers on every request. There’s no login call, no token to refresh, and keys don’t expire.

Environments

Sandbox and production have separate keys. No real funds move in sandbox.

Create an API key

API access is available once your business KYC is approved.
1

Open API Keys

Sign in to app.yativo.com and go to Developers → API Keys.
2

Generate a key

Click Generate key. Enter a Label (for example “Production backend”) and the Allowed IPs of the servers that will use the key. See IP whitelisting.
3

Save the secret

Copy the API secret and store it in a secrets manager. It’s shown only once and can’t be recovered.

Authenticate requests

Send both headers on every request. Don’t send an Authorization header with them.
Requests made with a key act on your business account. Some endpoints can’t be called with a key and return 403 This endpoint cannot be used with an API key. Do these in the dashboard instead:
  • Passkeys, two-factor authentication, PIN changes and generating an app secret
  • Deleting the account
From 15 October 2026, API keys and IP whitelists can also only be managed in the dashboard. Requests from anywhere else, including with an API key, return 403 IP whitelists and API keys can only be managed from the Yativo dashboard.

Check your setup

Call GET /ip-whitelist/check from each server that uses the key. It confirms the key works and whether that server’s IP is allowed.

Migrate from legacy API keys

Request and response bodies don’t change. Only the authentication headers do.
1

Find your server IPs

Run curl https://checkip.amazonaws.com on every server that calls Yativo.
2

Create a key per system

Create one API key per system with its allowed IPs, so you can revoke one without affecting the others.
3

Update your client

Remove the /auth/login call, token caching and refresh, and the Authorization header. Add X-Api-Key and X-Api-Secret to every request.
4

Test and go live

Test in sandbox, run GET /ip-whitelist/check from each production server, then deploy before 14 October 2026. IP whitelists are enforced from midnight that day.
5

Remove the old secret

Delete the legacy Account ID and App Secret from your configuration.

Idempotency

All POST, PUT, and PATCH requests require an Idempotency-Key header. This ensures safe retries without risk of duplicate operations.
Use a UUID or any unique identifier you generate per request. On retry, Yativo returns the original response without re-processing.

Errors


Security best practices

  • Store the key and secret in a secrets manager or environment variables. Never commit them or log them.
  • Only call the API from your backend. Never put a key in a browser or mobile app.
  • Use a separate key for each system and environment.
  • Revoke a key straight away if you think it has leaked, then create a new one.
  • Turn on two-factor authentication and passkeys for everyone who signs in to the dashboard.