Skip to main content

Build your first customer environment

The Partner API gives your platform a durable control plane for customer organizations: atomic provisioning, short-lived application authority, release convergence, entitlement control, worker identity, and signed operational alerts.

1. Store your partner key​

Your ykp_ key is a long-lived machine credential bound to one platform. It is shown once. Store it in a secret manager, send it only as a Bearer credential, and rotate it without placing it in browser code or logs.

Examples use this obviously fake credential:

ykp_00000000-0000-4000-8000-000000000001.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

2. Provision a customer​

curl -i https://api.example.yekar.ai/api/partner/v1/organizations \
  -H 'Authorization: Bearer ykp_00000000-0000-4000-8000-000000000001.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
  -H 'Idempotency-Key: customer-example-001' \
  -H 'Content-Type: application/json' \
  --data '{
    "clientName": "Example Customer",
    "clientSegment": "example-customer",
    "directLoginDisabled": true,
    "ownerEmail": "[email protected]",
    "ownerName": "Example Owner",
    "domainName": "General"
  }'

The API returns 202 Accepted: the customer organization and its fleet relationship are committed atomically, while the returned onboardingStatus tells you whether the reconciled owner, domain, and current release have completed. Keep the returned orgId; it is the customer identifier used by the remaining Partner API.

Always retry the same logical provisioning request with the same Idempotency-Key. A completed retry within seven days replays the accepted result without creating a second customer.

3. Mint a short-lived application token​

curl https://api.example.yekar.ai/api/partner/v1/token \
  -H 'Authorization: Bearer ykp_00000000-0000-4000-8000-000000000001.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
  -H 'Content-Type: application/json' \
  --data '{
    "orgId": "00000000-0000-4000-8000-000000000010",
    "appId": "00000000-0000-4000-8000-000000000020"
  }'

The response contains a ykt_ Bearer token and expiresIn: 3600. The example below is fake and abbreviated; real tokens are JWTs:

ykt_eyJhbGciOiJIUzI1NiIsImtpZCI6InB0ay0xIn0.eyJzdWIiOiJleGFtcGxlIiwiZXhwIjo0MTAyNDQ0ODAwfQ.ZXhhbXBsZS1ub3QtYS1yZWFsLXNpZ25hdHVyZQ

Mint leases server-side when needed. Token validation continuously follows current key, customer, platform, and partner standing, so suspension or detachment closes access within the standing-cache bound.

Next​