Sep 30, 2026 · Sotonye McLeod Bob-Manuel · Last Updated: October 1, 2026
From 15 October 2026, integrations must call the Yativo API with an API key, not a login token. The old login with account_id + app_secret stops working for server-to-server calls on that date, and will be removed later.
Three things change for integrators:
X-Api-Key and X-Api-Secret on every request. No login call, no token refresh, no expiry.Why: legacy API keys tie server access to a single account-wide secret. API keys are separate from any person's login, can be revoked one at a time, and are tied to known server IPs.
| When | What changes |
|---|---|
| Now | API keys and passkeys are live. Create keys, test in sandbox, add passkeys. |
| Midnight, 14 October 2026 | IP whitelists are enforced. Requests from IPs not on the key are rejected. |
| 15 October 2026 | Legacy login cut off. Server calls need API keys; login tokens only work in the dashboard. |
| Date to be announced | auth/login with app secret and generate-secret are removed. |
Integrators can switch today. On 15 October 2026, login tokens stop working from servers, so any integration still on the old login breaks. The old endpoints are removed later, on a date still to be announced.
An API key is a pair of values that lets your servers call Yativo without logging in. Send both on every request:
X-Api-Key: yativo_pk_...
X-Api-Secret: yativo_sk_...
| API key | API secret | |
|---|---|---|
| Header | X-Api-Key |
X-Api-Secret |
| Starts with | yativo_pk_ |
yativo_sk_ |
| Visible later | Yes, in the dashboard | No. Shown once, when the key is created |
https://app.yativo.com.