Authentication

Developer Assessment API keys

Issued to an organisation member for /api/v1/*.

• Header: x-api-key: sk_…
• Shown once at creation. If lost, revoke and create a new key.
• Default scopes: assessment:read, assessment:write.
• Stored hashed; Yareta cannot retrieve the raw key later.

Create/revoke keys from the product (developer settings) or ask your Yareta admin. Keys belong to an organisation; results are isolated to that org.

Never ship these keys in a mobile app or frontend bundle.

Zapier keys

Separate table from developer keys. Same header name x-api-key, not interchangeable. Use only on /api/zapier/*.

OAuth 2.0 (authorization code)

For apps where a Yareta user signs in. Yareta issues:

• Access token (JWT, 1 hour)
• Refresh token (~30 days, rotating)

Send:

Authorization: Bearer <access_token>

to POST https://platform.yareta.ai/api.

Token exchange must happen on your server. Never expose client_secret in a browser.

Full flow: OAuth.

Partner GraphQL without OAuth

Approved server-side partners may receive a dedicated credential. Treat it like a password. Do not use it from browsers.