API tokens

API tokens give scripts and AI agents headless access to a workspace's tasks through the REST API — no browser session required. Each token is tied to one workspace and to the member who created it.

Creating a token

Open Workspace → API tokens in the sidebar and generate a token:

• Name — what this token is for ("Claude Code", "CI reporter").
• Scope — Read (tasks:read) allows listing and fetching tasks; Write adds tasks:write for creating, editing and commenting.
• Expiry — never, or 7 / 30 / 90 days.

The token (prefixed yk_) is shown once at creation — copy it immediately. Yoke stores only a hash, so a lost token can't be recovered, only replaced.

Managing tokens

The same page lists every token with its scope, expiry, and last-used time. From there you can:

• Revoke a token instantly — requests with it start failing with 401.
• Inspect activity — an audit log records each request's method, path, and response status, so you can see exactly what an agent did. Audit entries are kept for 30 days.

Limits

Each token gets 120 requests per minute (token bucket — short bursts up to 120 are fine). Past that, requests return 429 with a Retry-After header.

Good practice

• One token per agent or integration, so revoking one doesn't break the others.
• Give read-only scope to anything that only reports.
• Set an expiry on tokens used in experiments.