Projects & API keys

Scope your integration with a project and authenticate requests with an API key.

Every integration with yield.xyz is organized around a project. A project holds the yields you’ve enabled, its fee configuration, and the API keys that authenticate requests on its behalf. You create and manage both projects and keys from the dashboard.

Projects

A project is the unit of configuration for an integration or business line. Each project has its own:

• Enabled yields: a project’s keys can only see and act on the yields enabled for it. GET /v1/yields returns only enabled yields, so a project with nothing enabled gets an empty list. Calling an action on a yield that isn’t enabled for the project returns 400 Bad Request with "Yield \"<id>\" is not enabled for this project".
• Fee configuration: deposit, performance, and management fees for enabled, fee-supported yields are set per project in the dashboard or through Programmatic access, never passed per request to the Yield API.
• API keys: one project can hold multiple keys.

Use one project per integration. Use multiple projects to separate products or white-label clients that need different enabled yields, fees, or keys.

API keys

An API key authenticates requests to the Yield API on behalf of the project it belongs to. A key inherits that project’s enabled yields and fee configuration.

1. Create a project

   Sign in to the dashboard and create a project if you don’t already have one.

2. Generate a key

   Open the project and create an API key. Give it a name; a note and an expiration date are optional. If you don’t set an expiration date, the dashboard applies a default.

3. Copy the key

   The key value is displayed at creation. Copy it before leaving the page.

Copy your key immediately after creation. If you lose it, generate a new one; there’s no way to retrieve the original value later.

Authenticating requests

Send the key on every request as the x-api-key header:

cURL

curl https://api.yield.xyz/v1/yields \
  -H "x-api-key: $YIELD_API_KEY"

A missing or invalid key returns 401 Unauthorized. See Authentication for the full request and error reference.

Base URL

The Yield API is served from https://api.yield.xyz, with endpoints under the /v1 prefix (for example, /v1/yields). See Base URLs for the full endpoint reference.

Managing keys

From the project page, you can:

Action	Effect
Edit	Change a key’s name, note, or expiration date
Rotate	Generate a replacement key without a separate deletion step
Delete	Revoke the key immediately. Any integration still using it loses access.

Deleting a key revokes access for any integration currently using it, with no undo. Rotate a key before removing it if you need continuity while you update your integration.

A key with an expiration date shows as Expires soon in the dashboard within 7 days of expiring, and enters a 24-hour grace period after expiring before it stops working. Rotate a key before it expires to avoid an interruption.

Enterprise teams that need to manage projects outside the dashboard can read Programmatic access.

Securing your keys

Server-side only

Make API calls from your backend. Never embed a key in client-side code or a mobile app bundle.

Environment variables

Store keys as environment variables or in a secrets manager, not in source control.

Rotate on a schedule

Rotate keys periodically and immediately if you suspect a key was exposed.

One key per deployment

Give each service or deployment its own key so you can revoke one without affecting the others.

Next steps

Quickstart

Use your key to discover a yield and request your first action.

Authentication

Full authentication and error reference for the Yield API.

Roles & permissions

Control which teammates can create or manage keys.

Rate limits

Understand request limits by plan.