Keys
List and revoke keys, and mint keys scoped to one profile.
Minting and revoking API keys, one per end customer or one per integration.
Mint a key for a profile
POST/profiles/{profileId}/keys
Mints an API key scoped to this profile and answers with it once. The key is what an integration acting for that one end customer holds: it reads and posts inside the profile and can reach nothing else, whatever the call says.
secret is the key itself and appears in this answer only. No API endpoint reads the secret back; the account owner can reveal any key in the console. Store it now, mint another, or go and look it up as yourself.
Only an unscoped key mints keys, and a key minted here is always scoped: there is no way to ask this endpoint for a key that reaches the account. A test key mints test keys only, so a CI run cannot produce something that publishes.
Rate limit: 60 requests per minute per API key, and 20 mints an hour per account. The second window is there because minting is the one call that makes more callers: every key it hands back carries a per-key budget of its own.
curl -X POST "https://api.yeetpost.com/api/v2/profiles/b2d1f0a3-5c6e-4f70-8a9b-0c1d2e3f4a5b/keys" \ -H "x-api-key: $YEETPOST_API_KEY" \ -H "content-type: application/json" \ -d '{ "name": "Acme integration", "type": "live", "redirectAllowlist": [ "https://acme.example.com" ]}'{ "key": { "id": "9c4e1d75-6b3a-4f28-9d10-7e5c2a8b4f31", "name": "Acme integration", "type": "live", "prefix": "yp_secret_4f9a2c", "profileId": "b2d1f0a3-5c6e-4f70-8a9b-0c1d2e3f4a5b", "redirectAllowlist": [ "https://acme.example.com" ], "createdAt": "2026-08-30T09:24:11.412Z", "lastUsedAt": null, "revokedAt": null }, "secret": "yp_secret_4f9a2c8e1b70d5a3c96f2e4b8d017a539e4a1d80b3f75c2e6a09d4b18f3c7e25"}path parameters
The profile's id.
request body (application/json)
What to call the key, so you can tell it apart later.
A live key publishes; a test key reaches sandbox connections only. It is spelled out rather than defaulted, because a key that can publish should not come from a field left out. A test key can only ask for test.
live | test
The origins this key's connect URLs may send an end customer back to, as bare origins such as https://acme.example.com. Normalized and deduped. Leave it out, or send an empty list, for any public https URL.
response 201
The key, and the secret it will never be answered with again.
headers: x-request-id, x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset
response body
What you called the key. Shown in the console and in these listings, never sent anywhere else.
A test key reaches sandbox connections only.
live | test
The first characters of the key, which is all any answer after the first says about it. Enough to tell two keys apart, and useless on its own. It is stored when the key is minted, so listing keys never decrypts a stored secret.
The profile this key is scoped to. Null for a key that reaches the whole account; a key minted over the API always carries one.
The origins this key's connect URLs may send an end customer back to. Null for any public https URL.
An ISO 8601 timestamp in UTC, in the same format as the timestamps you send in: 2026-08-26T09:24:11.412Z.
The key itself. This is the only answer that carries it: no API endpoint reads the secret back; the account owner can reveal any key in the console.
errors
A malformed profile id, a name outside 1 to 80 characters, a type that is not live or test, or a redirect allowlist entry that is not a bare origin.
Missing or invalid API key.
The key is scoped to a profile and cannot manage keys (forbidden), a test key asked for a live key (forbidden), or the profile already has 50 keys of that type (limit_exceeded; a revoked key does not count).
No profile of yours has that id.
More than 60 requests in a minute for this API key. Back off and retry.
Something went wrong on our side. Quote the x-request-id when you report it. A failure can happen before the rate limit is checked, so this response carries the request id and nothing else.
What each code means and the fix: errors.
List a profile's keys
GET/profiles/{profileId}/keys
Lists the keys scoped to this profile, oldest first. Keys are listed by their first characters; no API endpoint reads the secret back, and the account owner can reveal any key in the console.
A test key sees the test keys and no live ones, the same rule that stops it revoking a live key.
Rate limit: 60 requests per minute per API key.
curl "https://api.yeetpost.com/api/v2/profiles/b2d1f0a3-5c6e-4f70-8a9b-0c1d2e3f4a5b/keys" \ -H "x-api-key: $YEETPOST_API_KEY"{ "keys": [ { "id": "9c4e1d75-6b3a-4f28-9d10-7e5c2a8b4f31", "name": "Acme integration", "type": "live", "prefix": "yp_secret_4f9a2c", "profileId": "b2d1f0a3-5c6e-4f70-8a9b-0c1d2e3f4a5b", "redirectAllowlist": [ "https://acme.example.com" ], "createdAt": "2026-08-30T09:24:11.412Z", "lastUsedAt": null, "revokedAt": null } ], "limit": 25, "offset": 0}path parameters
The profile's id.
query parameters
List the revoked keys too. Left out, only the keys that still authenticate are listed.
true | false
How many keys to return.
How many keys to skip, for paging.
response 200
The profile's keys.
headers: x-request-id, x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset
response body
What you called the key. Shown in the console and in these listings, never sent anywhere else.
A test key reaches sandbox connections only.
live | test
The first characters of the key, which is all any answer after the first says about it. Enough to tell two keys apart, and useless on its own. It is stored when the key is minted, so listing keys never decrypts a stored secret.
The profile this key is scoped to. Null for a key that reaches the whole account; a key minted over the API always carries one.
The origins this key's connect URLs may send an end customer back to. Null for any public https URL.
An ISO 8601 timestamp in UTC, in the same format as the timestamps you send in: 2026-08-26T09:24:11.412Z.
errors
A malformed profile id, an includeRevoked that is not true or false, a limit outside 1 to 100, or a negative offset.
Missing or invalid API key.
The key is scoped to a profile, and managing keys is an account capability.
No profile of yours has that id.
More than 60 requests in a minute for this API key. Back off and retry.
Something went wrong on our side. Quote the x-request-id when you report it. A failure can happen before the rate limit is checked, so this response carries the request id and nothing else.
What each code means and the fix: errors.
Revoke a profile's key
DELETE/profiles/{profileId}/keys/{keyId}
Revokes one key of this profile. The key stops authenticating immediately, on every surface at once, and the row stays so the key still lists with includeRevoked=true.
Revoking is idempotent: a key that was already revoked answers the same 200, and the time it was first revoked stays.
One thing outlives the key: a connect URL it already issued keeps working for the rest of its fifteen minutes. The link carries its own single-use token and was authorized when it was created, so revoking the key that made it does not close it.
A test key may revoke test keys only. A live key of yours answers 404 not_found to a test key, the same answer a key of somebody else's account gets, so test credentials cannot be used to probe for live key ids.
Rate limit: 60 requests per minute per API key.
curl -X DELETE "https://api.yeetpost.com/api/v2/profiles/b2d1f0a3-5c6e-4f70-8a9b-0c1d2e3f4a5b/keys/9c4e1d75-6b3a-4f28-9d10-7e5c2a8b4f31" \ -H "x-api-key: $YEETPOST_API_KEY"{ "id": "9c4e1d75-6b3a-4f28-9d10-7e5c2a8b4f31", "revoked": true}path parameters
The profile's id.
The key's id, from the answer that minted it or from a listing.
response 200
The key is revoked, and was already revoked if you asked twice.
headers: x-request-id, x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset
response body
true
errors
A malformed profile id or key id.
Missing or invalid API key.
The key is scoped to a profile, and managing keys is an account capability.
No profile of yours has that id, that profile has no such key, or a test key asked for a live key.
More than 60 requests in a minute for this API key. Back off and retry.
Something went wrong on our side. Quote the x-request-id when you report it. A failure can happen before the rate limit is checked, so this response carries the request id and nothing else.
What each code means and the fix: errors.
List your keys
GET/keys
Lists your account's own keys, the unscoped ones and every profile's, oldest first, each with the profile it is scoped to. Keys are listed by their first characters; no API endpoint reads the secret back, and the account owner can reveal any key in the console.
Only an unscoped key may read this: a scoped key gets 403 forbidden rather than a listing of one. A test key sees the test keys and no live ones.
Rate limit: 60 requests per minute per API key.
curl "https://api.yeetpost.com/api/v2/keys" \ -H "x-api-key: $YEETPOST_API_KEY"{ "keys": [ { "id": "1a7f0c62-8d34-4b91-8f27-6c5b3e2d9a10", "name": "Server key", "type": "live", "prefix": "yp_secret_0b31de", "profileId": null, "redirectAllowlist": null, "createdAt": "2026-08-12T11:02:44.108Z", "lastUsedAt": "2026-08-30T09:24:11.412Z", "revokedAt": null }, { "id": "9c4e1d75-6b3a-4f28-9d10-7e5c2a8b4f31", "name": "Acme integration", "type": "live", "prefix": "yp_secret_4f9a2c", "profileId": "b2d1f0a3-5c6e-4f70-8a9b-0c1d2e3f4a5b", "redirectAllowlist": [ "https://acme.example.com" ], "createdAt": "2026-08-30T09:24:11.412Z", "lastUsedAt": null, "revokedAt": null } ], "limit": 25, "offset": 0}query parameters
List the revoked keys too. Left out, only the keys that still authenticate are listed.
true | false
How many keys to return.
How many keys to skip, for paging.
response 200
Your keys.
headers: x-request-id, x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset
response body
What you called the key. Shown in the console and in these listings, never sent anywhere else.
A test key reaches sandbox connections only.
live | test
The first characters of the key, which is all any answer after the first says about it. Enough to tell two keys apart, and useless on its own. It is stored when the key is minted, so listing keys never decrypts a stored secret.
The profile this key is scoped to. Null for a key that reaches the whole account; a key minted over the API always carries one.
The origins this key's connect URLs may send an end customer back to. Null for any public https URL.
An ISO 8601 timestamp in UTC, in the same format as the timestamps you send in: 2026-08-26T09:24:11.412Z.
errors
An includeRevoked that is not true or false, a limit outside 1 to 100, or a negative offset.
Missing or invalid API key.
The key is scoped to a profile, and managing keys is an account capability.
More than 60 requests in a minute for this API key. Back off and retry.
Something went wrong on our side. Quote the x-request-id when you report it. A failure can happen before the rate limit is checked, so this response carries the request id and nothing else.
What each code means and the fix: errors.
Revoke a key
DELETE/keys/{keyId}
Revokes any key of your account, scoped or not. The key stops authenticating immediately.
A key may revoke itself: the call answers 200, and the next request made with it is 401 unauthorized.
Revoking is idempotent: a key that was already revoked answers the same 200, and the time it was first revoked stays.
One thing outlives the key: a connect URL it already issued keeps working for the rest of its fifteen minutes. The link carries its own single-use token and was authorized when it was created, so revoking the key that made it does not close it.
A test key may revoke test keys only. A live key of yours answers 404 not_found to a test key, the same answer a key of somebody else's account gets, so test credentials cannot be used to probe for live key ids.
Rate limit: 60 requests per minute per API key.
curl -X DELETE "https://api.yeetpost.com/api/v2/keys/9c4e1d75-6b3a-4f28-9d10-7e5c2a8b4f31" \ -H "x-api-key: $YEETPOST_API_KEY"{ "id": "9c4e1d75-6b3a-4f28-9d10-7e5c2a8b4f31", "revoked": true}path parameters
The key's id, from the answer that minted it or from a listing.
response 200
The key is revoked, and was already revoked if you asked twice.
headers: x-request-id, x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset
response body
true
errors
A malformed key id.
Missing or invalid API key.
The key is scoped to a profile, and managing keys is an account capability.
No key of yours has that id, or a test key asked for a live key.
More than 60 requests in a minute for this API key. Back off and retry.
Something went wrong on our side. Quote the x-request-id when you report it. A failure can happen before the rate limit is checked, so this response carries the request id and nothing else.
What each code means and the fix: errors.