Empezar

Primeros pasos

Autenticación

Esta referencia está en inglés. La navegación y las etiquetas están traducidas.

Every request outside the public endpoints needs an API key, sent as a Bearer token.

API keys

Keys look like ys_live_ followed by 32 letters and digits. Send one in the Authorization header:

Authorization: Bearer ys_live_…

A missing, malformed or revoked key gets 401 unauthenticated. A valid key on an account without an active paid plan gets 402 subscription_required. Revoking a key takes effect within seconds.

Create and revoke keys in Settings → API & MCP. An account can have up to 5 active keys.

Solicitud
curl https://yieldsniper.finance/api/v1/screens/latest \
  -H "Authorization: Bearer $YS_API_KEY"
Missing or revoked key401
{
  "type": "https://yieldsniper.finance/developers/errors#unauthenticated",
  "title": "Authentication required",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Send an API key as \"Authorization: Bearer ys_live_…\" (Settings → API & MCP), or sign in.",
  "request_id": "req_2871134af25ca55878068f9f"
}

Scopes

Each key carries one or more scopes. Calls outside them get 403 forbidden.

  • readEvery GET endpoint and every MCP tool.
  • watchlists:writeCreate, update and delete saved queries and watchlists. Use together with read.

Give each key the smallest set of scopes it needs. A dashboard that only reads needs read.

Keeping keys safe

  • Shown once. We store a SHA-256 hash and the last 4 characters, so a lost key can't be recovered: revoke it and create a new one.
  • Server side only. Keep keys in environment variables or a secret manager. Never put them in browser code, mobile apps or a public repository.
  • One key per app or person, named after where it runs, so you can revoke one without breaking the others. Settings shows when each key was last used.
  • Rotate by creating the new key, deploying it, then revoking the old one.
  • If a key leaks, revoke it right away in Settings. Usage per day is shown there too.
We never ask for your key by email or chat, and support never needs it. Share the request_id of a response instead.

Browser sessions

The Yield Sniper web app calls the same API with your sign-in cookie instead of a key. Key management (/api/v1/keys) and usage (/api/v1/usage) only accept that session: a key can't create or revoke keys.