API keys and authentication

Authentication to the external API is done via API keys, distinct from user credentials. A key identifies an organization and has specific permissions.

Generating a key

1. 1

   Open the API panel

   Go to Administration -> API. Only users with Owner or Admin role can manage keys.

2. 2

   Create a new key

   Assign a descriptive name (e.g. "PMS production", "Zapier dev") and select the permission level.

3. 3

   Copy the value immediately

   The key is shown only once. Store it securely: a password manager, a vault, an environment variable. yourang.ai stores only the hash and cannot show it to you again.

4. 4

   Configure the external system

   Paste the key into the system that will call the API. The test call confirms everything works.

Permission levels

• Read. Read-only: contacts, orders, calls, statistics. Ideal for dashboards, reports, pull-based synchronizations.
• Write. Read + create/modify data: add contacts, register orders, create reservations. For two-way integrations.
• Write + outbound calls. Includes the ability to trigger outbound calls. It's the most powerful permission, to be assigned only to trusted systems.

Using the key

Each request includes the key in the HTTP Authorization header as a Bearer token. Example: Authorization: Bearer yr_live_abc123. The API validates the key, identifies the organization, and applies permissions before processing the request.

Rotation and revocation

Best practice: rotate keys at least once a year or whenever the staff managing them changes. Revocation is immediate: by clicking "revoke" the key stops working instantly. Always create a new key before revoking the old one, to avoid service interruption.

Open the developer portal

API console, request logs, browsable OpenAPI.

Go to the API overview

REST endpoints, authentication, practical examples.