API Keys
API keys are owned by a team workspace and carry permissions plus optional webhook delivery.
API keys can only be created and used in an active team workspace. Personal workspaces cannot create or call API keys. The team workspace Owner or Admin can manage its keys.
An API key permanently scopes credits, usage, tasks, uploaded assets, and webhook delivery to that team workspace. See Team Workspaces and API Access.
Each API key can carry its own async task delivery settings:
- One
webhook_url - One
webhook_secret - One
webhook_enabledswitch - One
webhook_eventsset
Scopes
| Scope | Capabilities |
|---|---|
v1:read | Models, quotes, task lookup, balance, and usage reads |
v1:generate | Image/video task creation and reference-image upload; normally combine with v1:read for quoting and polling |
Missing permission returns 403 scope_forbidden.
Recommended console flow
- Sign in to the Yeehoo console and switch to a team workspace
- Create an API key for one environment or one customer
- Assign only the scopes you need
- If you need push delivery, configure webhook fields on that same key
Webhook settings
webhook_url
: HTTPS endpoint that receives final task events
webhook_secret
: Secret used to validate X-Yeehoo-Signature
webhook_events
: Supports task.succeeded, task.failed, and task.canceled
webhook_enabled
: Master switch for push delivery
Why bind webhook to API key
This keeps ownership and routing clear:
- Different customers can receive callbacks at different endpoints
- Test and production keys can point to different receivers
- Polling remains available even if webhook delivery is enabled