The Yalango API

The Yalango API lets you work with your own decks and cards from a script instead of the web app. It is built for automating your own account - collecting words from something you read, syncing from a tool you already use, or bulk-adding vocabulary you gathered elsewhere.

It is available to every signed-in account with a verified email address. You do not need Premium, though the free plan limits on decks and cards still apply.

The base URL

https://yalango.com/api/v1

Every endpoint sits under that prefix. The v1 is part of the URL, so a future version can be added without changing anything that already works - see Compatibility below.

Authentication

Requests carry an API key in the Authorization header:

curl https://yalango.com/api/v1/decks \
  -H "Authorization: Bearer yal_your_key_here"

There is no other way to pass the key. Query parameters are deliberately not supported, because URLs end up in server logs and browser history in a way that headers do not.

Create and manage your API keys in settings.

What you can do

Endpoint	What it does
`GET /v1/decks`	List your decks
`POST /v1/decks`	Create a deck
`PATCH /v1/decks/{deckDocId}`	Update a deck
`POST /v1/decks/{deckDocId}/cards`	Add up to 100 cards

Deleting decks and cards, editing existing cards, and tables are not available yet.

A first request

This lists your decks, newest first:

curl https://yalango.com/api/v1/decks \
  -H "Authorization: Bearer yal_your_key_here"

{
  "decks": [
    {
      "doc_id": "8sKd92mfPqR1xLvBn4Tz",
      "id": 48210937465,
      "name": "Spanish verbs",
      "description": "",
      "source_ISO_639-1": "en",
      "target_ISO_639-1": "es",
      "privacy": "private",
      "number_of_items": 214,
      "tags": "",
      "created_timestamp": "2026-01-14T09:22:31.000Z",
      "last_updated_timestamp": "2026-03-02T18:05:12.000Z"
    }
  ],
  "next_cursor": null
}

The doc_id is what every other endpoint uses to identify a deck. The numeric id is the one that appears in a public deck URL.

Browsers are not supported

The API sends no CORS headers, so it cannot be called from front-end JavaScript in a browser. This is intentional rather than a gap: any key used from a web page is visible to everyone who loads it. Call the API from a server, a terminal, or a local script.

Compatibility

Within v1, fields may be added to a response but never removed or renamed, so it is safe to parse a response and ignore the parts you do not need. Requests are strict in the other direction: an unrecognised field is rejected rather than ignored, so a typo surfaces immediately instead of silently doing nothing.

Every response includes an X-API-Version header. If v1 is ever retired, responses will start carrying Deprecation and Sunset headers well before it stops working.