Projects & API Keys

Organize integrations and authenticate API requests

Projects

A project represents your integration with Yield.xyz. Projects provide logical separation for different products, environments, or business units — each with its own API keys, fee configurations, and usage analytics.

Single product

One project for your entire application — simplest setup for most integrations.

Multi-tenant

Separate projects per product line or white-label client — useful for platforms serving multiple brands.

Start with a single project. You can always add more later as your integration grows.

---

API Keys

API keys authenticate your requests to the Yield.xyz API. Each key is scoped to a project and environment.

Creating API Keys

API keys are created in the Yield.xyz Dashboard. Navigate to Settings → API Keys to generate new keys.

Copy your API key immediately after creation. Keys are only displayed once. If lost, generate a new one and revoke the old key.

Authentication

Include your API key in the x-api-key header on every request:

curl https://api.yield.xyz/v1/yields \
  -H "x-api-key: your_api_key_here"

---

Key Permissions

Read-Only

For discovery and portfolio tracking

• Query yields (GET /yields)
• Fetch balances and positions
• List networks and providers

Cannot: Create actions, submit transactions

Use case: Public-facing dashboards, yield browsers

Read-Write (Default)

For full integrations

• All read operations, plus:
• Create enter/exit/manage actions
• Submit transaction hashes
• Track action lifecycle

Use case: Wallet integrations, earn products

---

Security Best Practices

Server-side only

Never expose API keys in client-side code. Make all API calls from your backend.

Environment variables

Store keys in environment variables, not source code. Never commit keys to version control.

Rotate regularly

Generate new keys periodically. Revoke immediately if a key is compromised.

Separate by environment

Use different keys for production, staging, and development. Never share keys across environments.

---

Error Responses

Status	Meaning
401 Unauthorized	Missing or invalid API key
403 Forbidden	Valid key but access denied (e.g., geoblocking)
429 Too Many Requests	Rate limit exceeded — retry after backoff

---

Next Steps

Quickstart

Run your first API request

Rate Limits

Understand rate limiting by plan