> ## Documentation Index
> Fetch the complete documentation index at: https://yieldxyz.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Projects & API keys

> Scope your integration with a project and authenticate requests with an API key.

Every integration with yield.xyz is organized around a **project**. A project holds the yields you've enabled, its fee configuration, and the API keys that authenticate requests on its behalf. You create and manage both projects and keys from the [dashboard](https://dashboard.yield.xyz).

## Projects

A project is the unit of configuration for an integration or business line. Each project has its own:

* **Enabled yields**: a project's keys can only see and act on the yields enabled for it. `GET /v1/yields` returns only enabled yields, so a project with nothing enabled gets an empty list. Calling an action on a yield that isn't enabled for the project returns `400 Bad Request` with `"Yield \"<id>\" is not enabled for this project"`.
* **Fee configuration**: deposit, performance, and management fees for enabled, fee-supported yields are set per project in the dashboard or through [Programmatic access](/documentation/advanced-setup/programmatic-access), never passed per request to the Yield API.
* **API keys**: one project can hold multiple keys.

Use one project per integration. Use multiple projects to separate products or white-label clients that need different enabled yields, fees, or keys.

## API keys

An API key authenticates requests to the Yield API on behalf of the project it belongs to. A key inherits that project's enabled yields and fee configuration.

<Steps>
  <Step title="Create a project">
    Sign in to the [dashboard](https://dashboard.yield.xyz) and create a project if you don't already have one.
  </Step>

  <Step title="Generate a key">
    Open the project and create an API key. Give it a name; a note and an expiration date are optional. If you don't set an expiration date, the dashboard applies a default.
  </Step>

  <Step title="Copy the key">
    The key value is displayed at creation. Copy it before leaving the page.
  </Step>
</Steps>

<Warning>
  Copy your key immediately after creation. If you lose it, generate a new one; there's no way to retrieve the original value later.
</Warning>

### Authenticating requests

Send the key on every request as the `x-api-key` header:

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.yield.xyz/v1/yields \
    -H "x-api-key: $YIELD_API_KEY"
  ```

  ```typescript TypeScript theme={null}
  const response = await fetch("https://api.yield.xyz/v1/yields", {
    headers: { "x-api-key": process.env.YIELD_API_KEY },
  });
  ```
</CodeGroup>

A missing or invalid key returns `401 Unauthorized`. See [Authentication](/api-reference/authentication) for the full request and error reference.

### Base URL

The Yield API is served from `https://api.yield.xyz`, with endpoints under the `/v1` prefix (for example, `/v1/yields`). See [Base URLs](/api-reference/base-urls) for the full endpoint reference.

## Managing keys

From the project page, you can:

| Action | Effect |
| - | - |
| Edit | Change a key's name, note, or expiration date |
| Rotate | Generate a replacement key without a separate deletion step |
| Delete | Revoke the key immediately. Any integration still using it loses access. |

<Warning>
  Deleting a key revokes access for any integration currently using it, with no undo. Rotate a key before removing it if you need continuity while you update your integration.
</Warning>

A key with an expiration date shows as **Expires soon** in the dashboard within 7 days of expiring, and enters a 24-hour grace period after expiring before it stops working. Rotate a key before it expires to avoid an interruption.

<Note>
  Enterprise teams that need to manage projects outside the dashboard can read [Programmatic access](/documentation/advanced-setup/programmatic-access).
</Note>

## Securing your keys

<Columns cols={2}>
  <Card title="Server-side only" icon="server">
    Make API calls from your backend. Never embed a key in client-side code or a mobile app bundle.
  </Card>

  <Card title="Environment variables" icon="file-code">
    Store keys as environment variables or in a secrets manager, not in source control.
  </Card>

  <Card title="Rotate on a schedule" icon="arrows-rotate">
    Rotate keys periodically and immediately if you suspect a key was exposed.
  </Card>

  <Card title="One key per deployment" icon="split">
    Give each service or deployment its own key so you can revoke one without affecting the others.
  </Card>
</Columns>

## Next steps

<Columns cols={2}>
  <Card title="Quickstart" icon="rocket" href="/documentation/get-started/quickstart">
    Use your key to discover a yield and request your first action.
  </Card>

  <Card title="Authentication" icon="key" href="/api-reference/authentication">
    Full authentication and error reference for the Yield API.
  </Card>

  <Card title="Roles & permissions" icon="user-shield" href="/documentation/advanced-setup/roles-permissions">
    Control which teammates can create or manage keys.
  </Card>

  <Card title="Rate limits" icon="gauge" href="/documentation/plans-limits/rate-limits">
    Understand request limits by plan.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.