Authentication
How to authenticate with the Yoku API.
API Key Management
Yoku uses Bearer token authentication with scoped API keys. Each key is tied to your organization and includes specific permissions.
API keys can be created & revoked in your organization settings.
Key Security Best Practices
- Never Expose in Client-Side Code
Your API keys should never be exposed in client-side code. Instead, you should proxy the request through your backend. If exposed, anyone could use your key and exceed your quotas.
- Use Different Keys Per Environment
You should use different keys per environment. This ensures if a key is compromised, it will not affect other environments; and the key can be easily revoked.
Development: yoku_test_*
Staging: yoku_staging_*
Production: yoku_live_*
- Monitor Key Usage
In your API key settings, you can see the usage of each key per month. This will help you identify any anomalous patterns and revoke keys if needed.