Authentication - Yuko Documentation

The Yuko API uses HTTP Bearer Authentication to authenticate requests. All API requests must be made over HTTPS. To authenticate, include your API key in the Authorization header of every request:

Authorization: Bearer YOUR_API_KEY

Create API keys in Shopify admin → Apps → Yuko Loyalty → Integrations → REST API. Keys start with py_. You can show or copy an existing key from the API keys list at any time. See REST API for the setup steps.

Scopes

Each key carries scopes in the form read:<scope> or write:<scope> (for example read:rewards), and write implies read. A request to an endpoint outside the key’s scopes returns 403 with the code insufficient_scope. See Scopes for the full list.

Authentication errors

Status	Code	Meaning
`401`	`missing_token`	No `Authorization: Bearer` header was sent.
`401`	`invalid_token`	The key is wrong or has been revoked.
`403`	`insufficient_scope`	The key doesn’t have the scope this endpoint needs.

Keeping keys secure

Keep your API keys secure. Do not expose them in client-side code, mobile app binaries, or public repositories. All API calls containing your secret key must be made from your backend server.