Skip to content
YarmillYarmill
Open Yarmill

Authentication

Authenticate every Ingest API request with an AppToken, and store it so it can be rotated.

Every Ingest API request carries an AppToken in the Authorization header. The token identifies which system the data came from, so Yarmill can attribute what you send.

ForDevelopers integrating an external systemWhereJSON HTTPS API

Send the token

Authorization: AppToken application_token_for_yarmill_access

The scheme name AppToken is part of the header value — it is not Bearer. A request with a missing or malformed token is rejected with 401 Unauthorized.

Authentication applies to every endpoint, including Ping. There is no unauthenticated health check.

The AppToken authorizes writes into your Yarmill instance. Never use it in client-side code, a mobile app, or anywhere an end user could read it. It belongs in server-to-server calls only.

Get a token

Tokens are issued manually by Yarmill support — there's no self-service endpoint, so request one before you start building. Email support@yarmill.com and ask for:

  • a test token, to develop and verify the whole flow before any production data moves, and
  • a production token, for the live integration.

Ask for both at once. They're separate tokens, and having the test one first means you never point development traffic at production.

Renewal works the same way: contact support rather than looking for an endpoint to call.

Store it so it can be rotated

A token is long-lived but not permanent, and either side can invalidate it:

  • You can revoke it at any time — for example if it leaks, or when the integration is decommissioned.
  • Yarmill revokes it only in response to a security incident.

Because of that, keep the token in configuration or a secret store, not in your application code. Rotating a token should be a config change, not a release.

We recommend treating a 401 on a previously working integration as "the token changed", not as a bug: alert someone, stop retrying, and fetch the current token from your configuration rather than re-deploying.