# Use the REST API

Send a key as a bearer token, call /api/v1, and read the OpenAPI spec.

Source: https://yaya.page/support/articles/developers/use-the-rest-api
Last updated: 2026-10-03

## Before you start
- A yaya account. About 5 minutes.
- A key. Make an account key at `/settings/api-keys` while signed in. See [API scopes and rate limits](/support/articles/developers/api-scopes-and-rate-limits).

## Call the API
1. Create a key at `/settings/api-keys` and copy it. yaya shows it once.
2. Send it as a bearer token on every request.
3. Call a route under `/api/v1` on `https://api.yaya.page`.

```
curl https://api.yaya.page/api/v1/profile \
  -H "Authorization: Bearer yaya_ak_..."
```

Account keys start with `yaya_ak_`. Workspace keys start with `yaya_sk_` and belong to one business. A workspace key never works on account routes.

> Note: The api host accepts only bearer keys, not a cookie session.

![The API keys page with the create-key form and scopes](/support/api-keys.png)
## Read the contract
The [API reference](/support/api-reference) lists every live endpoint with its scopes and a curl example. `GET /openapi.json` on the app returns the full OpenAPI document, with every request, response and error shape.

## Read an error
Every error is JSON with `error`, `code`, `message` and `request_id`. The same id comes back in the `x-request-id` header. Quote it when you write to support@yaya.page.

The `code` is one of: `bad_request`, `invalid_json`, `invalid_request`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `gone`, `rate_limit_exceeded`, `service_unavailable`, `internal_error`.

## Fix common problems
**401 unauthorized.** The key is missing, revoked, expired or not valid for that workspace. See [Fix API authentication errors](/support/articles/developers/fix-api-authentication-errors).

**429 rate_limit_exceeded.** Wait for the `Retry-After` seconds, then retry.