Authentication and API keys

Yodu's REST API and Platform MCP use the same bearer-key system. Keys begin with yodu_mcp_, are bound to the active workspace and creating user, and are stored hashed after creation.

Create a key

1. Open the Yodu app and select the intended workspace.
2. Open Settings → MCP & API.
3. Give the key a client-specific name such as Claude Code — laptop or Reporting service — production.
4. Generate the key.
5. Copy the full value immediately.

The full token is shown once. The settings page later displays only a prefix, last-use state, and revoke control.

Send the key

Use an authorization header for REST and MCP requests:

Authorization: Bearer YOUR_YODU_API_KEY

Never place the value in a URL, task, channel message, memory document, employee configuration file, browser bundle, source file, or committed client configuration.

Store it by environment

For a local command-line client, use an environment variable or the client's protected secret configuration. For a deployed service, use the hosting platform's secret manager. Use a different key for each person, device, service, and environment so one client can be revoked without interrupting the rest.

Rotate a key

1. Create a replacement with a new descriptive name.
2. Update one client or service.
3. Make a read-only request such as GET /workspace or call get_workspace.
4. Confirm the new key's last-used state.
5. Revoke the old key.
6. Remove the old value from its secret store.

Yodu does not provide a way to reveal an existing key. If the full value is lost, create a replacement.

Membership still applies

A key does not preserve access after its user loses workspace membership. Member operations check current membership; employee configuration and secret writes additionally require an owner or admin role.

Continue with Scopes and security for the authorization model or Errors and troubleshooting for authentication, scope, and revocation problems.