Yara uses API keys to authenticate requests. You generate and manage them in the dashboard under API keys.
API keys
Pass your secret key in the x-yara-api-key header on every request.
You can also send it as an Authorization header if you prefer:
Keys are scoped to an environment — sandbox or production — so you can tell test traffic from live traffic.
Your secret key grants full access to your account. Keep it server-side, never commit it to source control, and never share it in places like Slack or client-side code. The full key is shown only once at creation — if you lose it, revoke it and generate a new one.
401 Unauthorized:
Idempotency
Write requests — creating an address, quoting, or initiating a transfer — require an X-Idempotency-Key header. Send a unique value (a UUID works well) for each distinct operation.
If a request is retried with the same key — after a network error or timeout — Yara returns the original result instead of performing the operation twice. This makes money movement safe to retry.
Generate a fresh idempotency key per operation and reuse it only when retrying that same operation.
Errors
Every error response has the same shape: an error object with a code and a message.
Next, learn how sandbox and production environments differ. 
