Skip to main content
API keys are created in the YoLead UI. Public API access must also be included in the company’s current plan. A valid key receives 403 with code 40351 when API access is unavailable on that plan. Each key has:
  • a public key used in X-YoLead-Key;
  • an API secret used to sign requests;
  • a scope: read or read-write.
Keep the API secret on your backend only. Do not expose it in browser code, mobile apps, logs, or analytics events.
Scopes: Scope and plan access are separate checks. For example, starting a new outbound chat requires both a read-write key and a plan that includes outbound chat initiation. If the plan does not include that feature, the embedded action returns 403 with code 40352.