API access

#Overview

The Yeap Cloud console runs on a set of HTTPS JSON APIs. This page explains where that API lives, how authentication works, and the current limits on programmatic access.

#API endpoint

https://api.yeap.cloud

• Authentication endpoints live under /auth/..., for example /auth/login and /auth/refresh-token.
• Endpoints that require a signed-in user live under /api/user/..., for example /api/user/profile.

Requests and responses are JSON. Send Content-Type: application/json with request bodies.

#Authentication

#Access token

When you sign in to the console, the server issues an access token (a JWT). To call endpoints under /api/user/..., send it in the request header:

Authorization: Bearer <access-token>

• Access tokens are valid for about 24 hours.
• If the token is missing, invalid or expired, the API returns HTTP 401:

{"error": "Unauthorized", "code": 401}

• If an account is deactivated, the tokens it was already issued stop working immediately.
• Signing out of the console invalidates the current access token and revokes the account's refresh tokens.

#Refresh token

If you tick 记住我 (Remember me) when signing in, the server also issues a refresh token that is valid for 14 days. When your access token expires, exchange the refresh token for a new access token instead of signing in again:

curl -X POST https://api.yeap.cloud/auth/refresh-token \
  -H "Content-Type: application/json" \
  -d '{"refresh_token": "<refresh-token>"}'

A successful response looks like this:

{"success": true, "token": "<new-access-token>", "user": { ... }}

If the refresh token is invalid or has expired, the response is {"success": false, "error": "Invalid or expired refresh token"} and you need to sign in again. The console handles this refresh for you automatically.

#Sign-in requires human verification

Every call to /auth/login must pass a human-verification challenge (the console shows it as a pop-up), and accounts with two-factor authentication must also enter a one-time code. As a result, unattended scripted sign-in is not currently possible.

#Example: read your profile

curl https://api.yeap.cloud/api/user/profile \
  -H "Authorization: Bearer <access-token>"

A successful response looks like this:

{"success": true, "data": {"id": 123, "username": "...", "email": "...", ...}}

Most user endpoints return the shape {"success": true, "data": ...}. Errors return {"success": false, "error": "description"}.

#"API keys" in Settings

The 个人设置 > API密钥 (Settings > API keys) tab lets you create, list and delete API keys:

1. Enter a description and click 生成密钥 (Generate key).
2. The key is shown only once. Copy it and store it somewhere safe straight away.
3. The 现有密钥 (Existing keys) list shows each key's ID, creation time and last-used time. Click 删除 (Delete) to remove keys you no longer need.

#The CDN "DNS API" page is not a Yeap Cloud credential

CDN管理 > DNS API (CDN > DNS API) at /cdn/dns-api stores your API credentials for a third-party DNS provider (currently Cloudflare). An API Token is recommended, with the Zone.Zone.Read and Zone.DNS.Edit permissions. These credentials are used to obtain SSL certificates for CDN domains automatically through DNS-01 validation. They have nothing to do with access to the Yeap Cloud API. See the CDN docs.

#Product-specific keys

Some products have their own keys that are separate from the console tokens on this page, for example LLM API > 密钥管理 (Key management). See the documentation for each product.

#Security recommendations

• Access and refresh tokens are equivalent to being signed in. Don't share them or commit them to source control.
• If you think a token has leaked, sign out of the console and change your password.
• Turn on two-factor authentication for your account.