Authentication

All public merchant API requests require an Authorization header with your Yera API Key.

curl https://app.yeraconnect.io/api/v1/checkout/sessions \
  -H "Authorization: Bearer yera_live_your_api_key" \
  -H "Content-Type: application/json"

• Merchant ID (MER_...): identifies your merchant account and never regenerates.
• Yera Live API Key (yera_live_...): locked until your account is approved, then issued automatically.
• Security Code: only used when connecting or reconnecting a website plugin — never on payment requests.

• Only Live API keys starting with yera_live_ authenticate new requests.
• Historical Test keys remain audit records and cannot authenticate.
• Live keys are rejected until the merchant account is approved.
• API requests must be made from trusted server-side code.
• Never expose API keys in browser code, mobile apps, or public repositories.
• Legacy yera_test_sk_ / yera_live_sk_ keys are retired and no longer authenticate.

• Live API keys can be regenerated from the dashboard.
• After regenerating an API key, the old key keeps working for 24 hours so you can update integrations.
• Regenerating the Security Code replaces the old code immediately; already-connected websites keep working.
• The Merchant ID is copy-only and cannot be regenerated.

Unified Yera API keys carry limited safe scopes by default: checkout_sessions:create, checkout_sessions:read, payments:read, plugin:connect, plugin:health, and webhooks:auto_register. Advanced scopes such as payment_links:create and webhooks:manage are granted by plan or admin approval.