API scopes and rate limits

Account key scopes

An account key carries only the scopes you tick when you create it. These are the seven scopes on Account API keys:

• profile:read: read your public profile.
• profile:write: update your profile, username and sites.
• email:write: change your sign-in email.
• billing:read: view payment methods and invoices.
• billing:write: manage payment methods.
• domains:read: view your domains.
• domains:write: manage your domains.

Give a key the fewest scopes the job needs. A key with profile:write cannot change your email or your payment methods.

Workspace key scopes

Workspace keys use two scopes: suite:read and suite:write. A key never has more access than the person who made it. Routes that move money need a key made by a workspace owner.

To make a workspace key, open Settings, choose API keys, name the key, tick Read or Write, and click Create key. Copy it from the dialog. yaya shows it once.

Rate limits

These limits are in the product today.

• Publishing: 10 requests per minute per IP address.
• Support requests: 10 per hour per user.
• Sign-in emails: 5 per minute per IP address.
• New workspaces: 5 per day.

A request over the limit gets a 429 with a Retry-After header and a retry_after field in the JSON body. Wait that many seconds.

Revoke a key

For an account key, open /settings/api-keys. For a workspace key, open Settings and choose API keys. Find the key and click Revoke. A revoked key stops working immediately.