Onboarding — get your credentials
You authenticate with an Ed25519 (EdDSA) key pair, base64-encoded. Onboarding is completed on Yumi's side from the public key you provide — there is no self-service sign-up.
Step 1 — Generate a key pair
Keep the secret key private; it never leaves your systems.
import * as nacl from 'tweetnacl';
import * as util from 'tweetnacl-util';
const kp = nacl.sign.keyPair();
console.log('publicKey :', util.encodeBase64(kp.publicKey)); // send this to Yumi
console.log('secretKey :', util.encodeBase64(kp.secretKey)); // KEEP SECRET
Step 2 — Send Yumi (over a trusted channel)
| Field | Notes |
|---|---|
publicKey | The base64 public key from Step 1. Never send the secret key. |
email | Contact address (used for key-rotation notices). |
:::warning Send the public key over a channel you trust Use signed email, a verified Slack, or read the key fingerprint back on a call. A wrong or swapped key simply means you can't mint tokens — it fails closed, never open. :::
Step 3 — Yumi provisions and confirms
Yumi assigns your partner id and sets everything up, then returns:
| Returned to you | Notes |
|---|---|
name (partner id) | Lowercase letters, numbers, underscores — e.g. acme_credit. Permanent. Appears as appName in webhooks. You never send it on API calls — it's derived from your token. |
| Webhook secret | Used to verify webhook signatures. See Webhooks. |
| Environment URLs | Staging and production base URLs. |
Once you have these, you're ready to authenticate →.