Environments
Sandbox and production have separate keys. No real funds move in sandbox.
Create an API key
API access is available once your business KYC is approved.1
Open API Keys
Sign in to app.yativo.com and go to Developers → API Keys.
2
Generate a key
Click Generate key. Enter a Label (for example “Production backend”) and the Allowed IPs of the servers that will use the key. See IP whitelisting.
3
Save the secret
Copy the API secret and store it in a secrets manager. It’s shown only once and can’t be recovered.
Authenticate requests
Send both headers on every request. Don’t send anAuthorization header with them.
403 This endpoint cannot be used with an API key. Do these in the dashboard instead:
- Passkeys, two-factor authentication, PIN changes and generating an app secret
- Deleting the account
403 IP whitelists and API keys can only be managed from the Yativo dashboard.
Check your setup
CallGET /ip-whitelist/check from each server that uses the key. It confirms the key works and whether that server’s IP is allowed.
Migrate from legacy API keys
Request and response bodies don’t change. Only the authentication headers do.1
Find your server IPs
Run
curl https://checkip.amazonaws.com on every server that calls Yativo.2
Create a key per system
Create one API key per system with its allowed IPs, so you can revoke one without affecting the others.
3
Update your client
Remove the
/auth/login call, token caching and refresh, and the Authorization header. Add X-Api-Key and X-Api-Secret to every request.4
Test and go live
Test in sandbox, run
GET /ip-whitelist/check from each production server, then deploy before 14 October 2026. IP whitelists are enforced from midnight that day.5
Remove the old secret
Delete the legacy Account ID and App Secret from your configuration.
Idempotency
AllPOST, PUT, and PATCH requests require an Idempotency-Key header. This ensures safe retries without risk of duplicate operations.
Errors
Security best practices
- Store the key and secret in a secrets manager or environment variables. Never commit them or log them.
- Only call the API from your backend. Never put a key in a browser or mobile app.
- Use a separate key for each system and environment.
- Revoke a key straight away if you think it has leaked, then create a new one.
- Turn on two-factor authentication and passkeys for everyone who signs in to the dashboard.

