API reference

Create a gateway in the dashboard, register the endpoints you want to expose, generate an API key, then call the proxy:

curl -X GET \
  "https://yourapi.dev/api/public/gw/<your-path>" \
  -H "x-api-key: yak_live_xxxxxxxxxxxxxxxx"

Send your key in the x-api-key header (or Authorization: Bearer <key>). Keys are stored hashed — the plaintext value is shown only once at creation. Keys can be scoped to specific HTTP methods, bound to a single gateway and given an expiry date.

Two limits apply: a burst limit per key per minute, and a monthly request quota per plan. Every proxied response includes headers so you can back off before you are throttled.

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 274
Retry-After: 27          # only on 429

Starter allows 60 requests/minute, Professional 300/minute and Enterprise 1,200/minute.

401  missing or invalid API key
403  key expired, out of scope, or quota exceeded
404  path not registered on the gateway
429  burst rate limit exceeded
502  upstream unreachable or timed out

Register endpoints in the dashboard to receive quota.threshold, request.failed, key.revoked and subscription.updated events. Each delivery is signed:

x-yourapi-event: quota.threshold
x-yourapi-timestamp: 1730000000
x-yourapi-signature: sha256=<hmac_sha256(secret, timestamp + "." + rawBody)>

Compare signatures with a constant-time function and reject stale timestamps.

Every proxied request is logged with method, path, status code and latency. Retention follows your plan: 7 days on Starter, 30 days on Professional and 90 days on Enterprise. Logs can be filtered and exported to CSV from the dashboard.