Authenticate with an API Key. Uses Yuque as the example to explain the fields and how to safeguard the key.
The API Key method takes the key issued by the target system directly. The console describes it this way: it completes authentication with an API Key.
Compared with OAuth 2.0, it requires no app registration in the target system and no authorization redirect — you enter a single string. The trade-off is that the key itself is a complete credential: once leaked, anyone can do whatever that key's permissions allow.
Yuque is currently the only App that uses this method.
Page hint: enter your Yuque API Key.
Together with the common Config name field, a Yuque auth config has only these two items.
In the second step of Create an auth config, select Yuque, paste the token into the API Key field, and click Finish.
The permissions of a Yuque token are fixed at creation time and cannot be changed afterward. A few recommendations:
Once submitted, the API Key is stored encrypted by the platform, and the console no longer displays the full value. But before submission it passes through your clipboard and browser, so:
After a token expires or is revoked, connectors based on that config change to Expired, and tool calls fail.
What to do: regenerate the token in Yuque, create a new auth config with the new value, rebuild the connector with the new config, and delete the old connector once you confirm the new one works.
Yuque
Page hint: enter your Yuque API Key.
| Field | Required | Description |
|---|---|---|
| API Key | Yes | The token issued by Yuque. The console's field hint says to obtain it from your Yuque personal settings → Token |
Obtain a token
1
Open the Yuque token page
Sign in with a Yuque membership account, then open the Token page in your personal settings. Creating a personal access token requires membership.
Open the Yuque token page
Yuque personal settings → Token
2
Create a personal access token
Create a new personal access token and select the permission scope you need. When you only need to read documents, do not grant write permissions.
3
Copy and store it
The token is shown in full only once, at creation time. Copy and store it immediately.
Enter it in the config
In the second step of Create an auth config, select Yuque, paste the token into the API Key field, and click Finish.
The permissions of the account behind the token determine which knowledge bases you can read. Creating the token with an account that can see only the target knowledge base is safer than using an admin account.
Recommendations for permission scopes
The permissions of a Yuque token are fixed at creation time and cannot be changed afterward. A few recommendations:
- Do not grant write permissions for read-only scenarios. An agent calling a write API by mistake has far more serious consequences than a read.
- One token per purpose. When you need to revoke one, only that one place is affected.
- For a knowledge base shared by a team, use a team token rather than one person's personal token, so the connector does not break when that person leaves.
Safeguarding the key
Once submitted, the API Key is stored encrypted by the platform, and the console no longer displays the full value. But before submission it passes through your clipboard and browser, so:
- Do not paste the token into chat tools, support tickets, or code repositories.
- Do not open a page containing the token while sharing your screen.
- If you suspect a leak, revoke the token in Yuque immediately, then create a new config.