# API scopes and rate limits

What each account key scope allows, and the limits that return a 429.

Source: https://yaya.page/support/articles/developers/api-scopes-and-rate-limits
Last updated: 2026-10-02

## Account key scopes
An account key carries only the scopes you tick when you create it. These are the seven scopes on **Account API keys**:

- `profile:read`: read your public profile.
- `profile:write`: update your profile, username and sites.
- `email:write`: change your sign-in email.
- `billing:read`: view payment methods and invoices.
- `billing:write`: manage payment methods.
- `domains:read`: view your domains.
- `domains:write`: manage your domains.

Give a key the fewest scopes the job needs. A key with `profile:write` cannot change your email or your payment methods.

## Workspace key scopes
Workspace keys use two scopes: `suite:read` and `suite:write`. A key never has more access than the person who made it. Routes that move money need a key made by a workspace owner.

To make a workspace key, open **Settings**, choose **API keys**, name the key, tick **Read** or **Write**, and click **Create key**. Copy it from the dialog. yaya shows it once.

## Rate limits
These limits are in the product today.

- Publishing: 10 requests per minute per IP address.
- Support requests: 10 per hour per user.
- Sign-in emails: 5 per minute per IP address.
- New workspaces: 5 per day.

A request over the limit gets a 429 with a `Retry-After` header and a `retry_after` field in the JSON body. Wait that many seconds.

## Revoke a key
For an account key, open `/settings/api-keys`. For a workspace key, open **Settings** and choose **API keys**. Find the key and click **Revoke**. A revoked key stops working immediately.