Authentication

API Keys

Every API request requires an API key passed as a Bearer token:

Authorization: Bearer sk_test_your_key_here

The SDK handles this automatically — pass your key to the constructor.

Base URL

All requests use the same base URL:

Your key prefix determines the environment:

See Sandbox vs Production for details.

Organization Scoping

API keys are scoped to the organization that created them. A key can only access data belonging to its organization.

const client = new EInvoice({ apiKey: 'sk_test_org123_key' });

Creating API Keys

Create keys from the dashboard or programmatically via the API:

curl -X POST https://gateway.useyona.com/a/v1/organizations/9f8e7d6c-5b4a-3210-fedc-ba9876543210/api-keys \
  -H "Authorization: Bearer sk_test_your_admin_key" \
  -H "Content-Type: application/json" \
  -d '{ "mode": "sandbox", "name": "backend-service" }'

Key Rotation

Rotate a key to generate a new one and deprecate the old:

curl -X POST https://gateway.useyona.com/a/v1/organizations/9f8e7d6c-5b4a-3210-fedc-ba9876543210/api-keys/{key_id}/rotate \
  -H "Authorization: Bearer sk_test_your_admin_key"

The old key has a deprecation grace period.

Security Best Practices

1. Never expose keys in client-side code. API keys are server-side only.
2. Use environment variables. Don’t commit keys to source control.
3. Use test keys for development. Switch to live keys only in production.
4. Rotate keys periodically. The rotate() method provides a grace period.
5. Revoke compromised keys immediately. revoke() is irreversible.
6. Use scoped keys. Assign roles with minimal permissions.

Error Responses