Get Started
Back to Docs

Authentication

Learn how to authenticate with the Yeld API and manage access.

Authentication Methods

Yeld supports multiple authentication methods for different use cases.

API Key

For server-to-server communication

Required Header:

Authorization: Bearer YOUR_API_KEY

Common Use Cases:

  • Backend integrations
  • Cron jobs
  • Automated scripts
import { YeldClient } from "@yeld/sdk";

const client = new YeldClient({
  apiKey: process.env.YELD_API_KEY,
});

JWT Token (Supabase)

For user-authenticated requests

Required Header:

Authorization: Bearer supabase_jwt_token

Common Use Cases:

  • User-specific operations
  • Dashboard actions
  • Personalized requests
// Client-side with Supabase
import { createClient } from "@supabase/supabase-js";

const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
);

// Get user's JWT
const { data: { session } } = await supabase.auth.getSession();
const token = session?.access_token;

Service Role

For admin operations (use with extreme caution)

Required Header:

Authorization: Bearer service_role_key

Common Use Cases:

  • Administrative tasks
  • Bulk operations
  • System integrations
// Server-only: Use service role for admin operations
import { createClient } from "@supabase/supabase-js";

const supabaseAdmin = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY!,
  {
    auth: {
      persistSession: false,
    },
  }
);

Never expose your service role key in client-side code. This key has full admin access.

Security Best Practices

  • Never Expose Secrets Client-Side

    API keys and service role keys should only be used in server-side code. Use environment variables to store secrets.

  • Rotate API Keys Regularly

    Generate new API keys periodically and revoke old ones. Monitor API usage for suspicious activity.

  • Use Environment Variables

    Store all secrets in environment variables, never in code. Use .env.local for local development and platform secrets for production.

  • Validate Requests

    Verify webhook signatures using your webhook secret. Check that requests come from expected sources.

Environment Variables

# Required
EVM_MASTER_MNEMONIC=your_master_mnemonic
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key
SUPABASE_SERVICE_ROLE_KEY=your_service_role_key

# Optional (for production)
YELD_API_KEY=your_api_key
YELD_WEBHOOK_SECRET=your_webhook_secret

Required Variables

  • EVM_MASTER_MNEMONICMaster seed for wallet derivation
  • NEXT_PUBLIC_SUPABASE_URLSupabase project URL

Security Note

Variables prefixed with \`NEXT_PUBLIC_\` are exposed to the browser. Never store secrets in these variables.

Rate Limits →