Authentication

All external API requests use a bearer token:

Authorization: Bearer sk_yeehoo_xxx

/v1/* resolves the owning team workspace from this API key. Do not attempt to switch workspaces with X-Yeehoo-Workspace-ID: /v1/* does not read this header, and it cannot change credit, task, or asset ownership. Read Team Workspaces and API Access first.

Requirements

• Every request must carry a valid API key
• Keys should be stored server-side
• Do not expose production keys inside browser code

Idempotency

Use Idempotency-Key on create-style endpoints, especially when a client may retry after timeout or network interruption.

Idempotency-Key: order-20260723-001

Recommended first-wave usage:

• /v1/generations
• Any future billing or order creation endpoints

The same key and body replay the original response with Idempotency-Replayed: true. Reusing a key with a different body returns 409 idempotency_conflict. If the first request is still running, the API returns 409 idempotency_in_progress with Retry-After: 2; wait and retry with the same key and body.

Session vs API Key

The /api/keys management endpoints belong to the Yeehoo console and use session auth.

• Console session token: for dashboard operations like creating keys
• API key bearer token: for external product integration