Start here

Authentication

One API key, two headers that carry it. Everything except the spec itself needs it.

#API keys

Create a key at app.yeetpost.com/app/settings. Keys look like yp_secret_... and carry the same access as your account, so treat one like a password.

headers

x-api-key: yp_secret_...
Authorization: Bearer yp_secret_...

Both work everywhere, REST and MCP alike. Bearer is there because that is what MCP clients and generated OpenAPI clients send. If you send both, x-api-key is the one that counts.

#What the spec says

x-api-key

Your yeetpost API key, from https://app.yeetpost.com/app/settings.

Authorization

The same API key as Authorization: Bearer <api-key>. x-api-key wins when both are sent.

GET /openapi.json is the one endpoint that takes no key. Everything else answers 401 unauthorized without one.

#Check a key works

Listing your connections is the cheapest authenticated call. A key that works gives you your slugs back.

curl "https://api.yeetpost.com/api/v2/connections" \
  -H "x-api-key: $YEETPOST_API_KEY"

#Calling from a browser

The API answers every origin with Access-Control-Allow-Origin: *, so a browser app can call it directly. It authenticates by header and sets no cookies.

Anything that reaches a browser is readable by the person sitting in front of it. Ship one key per user rather than your own.

The rate limit and request id headers are listed in Access-Control-Expose-Headers, so browser code can read them too. See rate limits and request ids.

#If a key leaks

Delete it in settings and create a new one. The security checklist covers the rest.