API keys and scopes
Create, protect, rotate, and revoke owner-bound YADL API keys for approved integrations.
API keys and scopes
An API key is an owner-bound secret for an approved YADL integration. It acts only as your account and is constrained by its scopes; it never gives an integration administrator access or access to another user's work.
Create and store a key
- Sign in and open Settings → Security.
- In Generate API Key, choose Create new secret key and give it a recognizable integration or environment name.
- Copy the complete
yadl_…secret immediately and store it in your connector or server-side secret manager. - Close the dialog. YADL displays the full secret only once; later, it shows only a masked value.
Never paste a key into client-side JavaScript, source control, a shared document, a chat prompt, or an API URL. A key is sent only as a bearer token in the Authorization header.
Scopes
YADL independently enforces these integration scopes:
| Scope | Allows |
|---|---|
catalog:read | Capability discovery, approved resource search, composition, and bounded repair. |
documents:read | Listing and reading documents owned by the key's account. |
documents:write | Creating or optimistic-saving documents owned by the key's account. |
preview:read | Validation, inspection, and private storyboard rendering/retrieval. |
exports:read | Reading export quota and owner-scoped export state. |
exports:write | Submitting an idempotent export for a saved owned document. |
The current Settings creator provisions the currently available integration scopes. Scope enforcement remains server-side for every request. Use separate, clearly named keys for separate connectors and disable a key as soon as an integration no longer needs it; that limits the effect of an accidental disclosure.
Rotate, disable, or remove
Use Disable to stop a key without deleting its audit-friendly record. Re-enable it only after confirming the integration is safe. Use Delete to permanently remove a key you no longer need. To rotate a key, create a replacement, update the connector, verify it works, then disable or delete the old key.
Changing a key's name does not change its secret. If you have lost the secret, create a new key; it cannot be shown again.
Owner and agent boundaries
API keys are for integrations with the same person or organization account that created them. They are not user-delegation credentials and must not be embedded in an MCP tool input. For an AI-agent workflow, use Agent API or MCP, where YADL preserves owner checks, scopes, validation, and export policy.