Agent Access

Agent Access gives you an Anchor API key without creating a dashboard account. The onboarding routes are unauthenticated — no anchor-api-key header yet. You get a short puzzle, submit the answer, and receive an api_key. Then call the rest of the Anchor API like any other customer.

Live today: GET /v1/agent-access/challenge and POST /v1/agent-access.
Also available (when deployed): GET /v1/agent-access — a self-describing guide for agents, with a next field pointing at the next HTTP call.

Quick start (human or script)

# 1. Get puzzle + token
curl https://api.anchorbrowser.io/v1/agent-access/challenge

# 2. Follow `next` and `challenge.prompt` from that response, then submit
curl -X POST https://api.anchorbrowser.io/v1/agent-access \
  -H "Content-Type: application/json" \
  -d '{"token":"<token from step 1>","answer":"42"}'

The POST response includes api_key. Use it as header anchor-api-key on all later requests.

What the puzzle is

Each challenge is a multi-step problem. Use the challenge response — especially next, challenge.prompt, and instructions — then POST the final integer as answer. Challenge data expires after 120 seconds — if POST fails with an expired token, start again from step 1.

If you are an autonomous agent

Treat Agent Access as a small state machine. When a response includes next, call it. When it does not, use the other fields in that same response.

GET /challenge  →  (follow next)  →  POST /  →  authenticated API (e.g. perform-web-task)
     ↑__________________ errors may send you back here __________________|

Step 1 — Challenge

GET /v1/agent-access/challenge returns:

challenge.prompt — the puzzle text
token — pass this to POST (not the answer)
next — when present, the next HTTP call before POST
instructions — hints (submit, credit amounts, headers)

{
  "token": "eyJ...",
  "challenge": { "prompt": "..." },
  "next": {
    "method": "GET",
    "path": "/v1/agent-access/...",
    "description": "..."
  },
  "instructions": {
    "submit": "POST /v1/agent-access with { token, answer }",
    "anonymous_credits": 1,
    "identity_credits": 5
  }
}

Step 2 — Submit (creates the key)

POST /v1/agent-access body:

{ "token": "<from challenge>", "answer": "<integer as string>" }

Success — you get the key plus next pointing at your first real API call:

{
  "api_key": "sk-...",
  "project_id": "...",
  "credits_granted": 1,
  "auth": {
    "api_key_header": "anchor-api-key",
    "identity_token_required": false
  },
  "next": {
    "method": "POST",
    "path": "/v1/tools/perform-web-task",
    "description": "You have an API key. Send header anchor-api-key ..."
  },
  "limits": { "session_max_duration_minutes": 60 }
}

Error — you get error, next (usually back to challenge), and docs:

{
  "error": "Incorrect answer",
  "next": {
    "method": "GET",
    "path": "/v1/agent-access/challenge",
    "description": "Get a fresh token, complete the challenge flow, then POST ..."
  },
  "docs": "https://docs.anchorbrowser.io/quickstart/agent-access"
}

Optional — Guide endpoint

GET /v1/agent-access does not create a key. It returns credits, limits, a flow array (all steps), and next → challenge. Useful when an agent discovers Anchor cold and needs the full playbook in one response.

Optional identity (1 → 5 credits)

Add identity_token on the same POST as token and answer:

No identity — 1 credit, anonymous trial
OIDC JWT with verified email — 5 credits; we know who you are

identity_provider is usually omitted — we detect the provider from the JWT iss claim (Google, GitHub Actions, Vercel). GitHub Actions tokens often have no email, so they still get 1 credit.

curl -X POST https://api.anchorbrowser.io/v1/agent-access \
  -H "Content-Type: application/json" \
  -d '{"token":"<token>","answer":"<answer>","identity_token":"<OIDC JWT>"}'

If the POST response sets auth.identity_token_required: true, also send header anchor-identity-token: <agent_identity_token> on later API calls (value is in the POST response).

After you have a key

curl -X POST https://api.anchorbrowser.io/v1/tools/perform-web-task \
  -H "anchor-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Go to example.com and return the page title","url":"https://example.com"}'

Agent Access keys have a 60-minute session cap. See Perform Web Task and Create a Session.

Endpoints

GET /v1/agent-access — guide for agents (next → challenge). Does not issue a key.
GET /v1/agent-access/challenge — puzzle + token + instructions + optional next
POST /v1/agent-access — submit answer → api_key + next

Introduction

Platform

Integrations

Account

Quick start (human or script)

What the puzzle is

If you are an autonomous agent

Step 1 — Challenge

Step 2 — Submit (creates the key)

Optional — Guide endpoint

Optional identity (1 → 5 credits)

After you have a key

Endpoints

​Quick start (human or script)

​What the puzzle is

​If you are an autonomous agent

​Step 1 — Challenge

​Step 2 — Submit (creates the key)

​Optional — Guide endpoint

​Optional identity (1 → 5 credits)

​After you have a key

​Endpoints

Quick start (human or script)

What the puzzle is

If you are an autonomous agent

Step 1 — Challenge

Step 2 — Submit (creates the key)

Optional — Guide endpoint

Optional identity (1 → 5 credits)

After you have a key

Endpoints