Skip to main content

​
Authentication

Every request to the Business API must include a valid API key in the X-API-Key header.

​
Obtaining an API Key

API keys are managed from the YaVendio Dashboard — there is no programmatic endpoint for key management.
1

Navigate to API settings

Log in to the YaVendio Dashboard and go to Settings → API Keys.
2

Create a new key

Click “Create API Key”. Assign a descriptive name (e.g., “ERP Integration”).
3

Copy your key

The full secret key is shown only once at creation time. Copy it and store it securely. Afterwards the dashboard only keeps its prefix (yv_live_v1_Xk3Rt9pQz...) for identification.

​
Key Format

A key looks like yv_live_v1_ followed by 43 random characters:
The dashboard always creates live keys. There is no sandbox environment: a test key would operate against the same production data, so there is no “safe” version of the credential to experiment with.

​
Using the API Key

Include the key in every request via the X-API-Key header:

​
Scopes

Today every API key has full access to every endpoint: the dashboard creates keys with no scopes assigned, and does not offer a way to pick them yet. The scope model itself is already implemented in the API. Each endpoint declares its own — orders:read, products:read, products:write, conversations:read, contacts:read, company:read, webhooks:read, webhooks:write, outbound:send, outbound:read — and each endpoint’s reference page names the one it needs. If a key had scopes assigned and were missing the one an endpoint requires, the request would get 403 Forbidden:
403 Forbidden
Until you can choose scopes, treat every key as a full-access credential: create one per integration and delete it when you stop using it.

​
Key States

Keys visible in the dashboard have two possible states:

​
Dashboard Information

The API keys table in the dashboard shows:
  • Name — the name you assigned when creating the key
  • Scope — always shows “Orders & Products” today, because every key is created with full access
  • Status — Active or Revoked
  • Secret Key — prefix only (yv_live_v1_Xk3Rt9pQz...)
  • Created — when the key was created
  • Last used — timestamp of the last API request made with the key
To delete a key, click the trash icon next to it. This action is irreversible — any integration using the key will immediately start receiving 401 errors.

​
Error Responses

401 Unauthorized

​
Best Practices

Never expose your API key in client-side code (browser JavaScript, mobile apps). Always call the API from your backend.
  • Use environment variables to store API keys — never hardcode them in source code.
  • Create separate keys for each integration or environment (development, staging, production).
  • Rotate keys periodically — delete the old key and create a new one from the dashboard.