Authentication

API keys

The public REST API uses an API key as a Bearer token. Create a key in the product and copy its secret when it is shown. Yep does not show the full secret again.

Authorization: Bearer <API_KEY>

Keep keys in a secret manager or environment variable. Do not put a key in browser code, a URL, source control, logs, or documentation examples.

Key lifecycle

Use a separate key for each application and environment so access can be revoked without interrupting unrelated workloads.

Choose a key's expiry when you create it: one day, one week, one month (30 days), one year (365 days), or never. An expired key stops authenticating. A key that never expires keeps working until you revoke it, so revoke it as soon as no workload needs it. Through the API, send expiration with 1d, 7d, 30d, 365d or never, or send expires_in_days from 1 through 365, but not both; with neither, the key expires after 90 days. A key's expires_at is null when it never expires.

When rotating a key:

1. Create the replacement key.
2. Deploy the replacement to every instance.
3. Confirm requests succeed with the replacement.
4. Revoke the previous key.

MCP authentication

MCP clients sign in with OAuth instead of an API key: the client opens the browser, where you approve access. The MCP server reference describes the flow and its scope.