> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anchorbrowser.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Access

> Self-serve API key for agents. Solve a short puzzle — no dashboard account required.

**Agent Access** gives you an Anchor API key without creating a dashboard account. The onboarding routes are **unauthenticated** — no `anchor-api-key` header yet.

You get a short puzzle, submit the answer, and receive an `api_key`. Then call the rest of the Anchor API like any other customer.

<Note>
  **Live today:** `GET /v1/agent-access/challenge` and `POST /v1/agent-access`.\
  **Also available (when deployed):** `GET /v1/agent-access` — a self-describing guide for agents, with a `next` field pointing at the next HTTP call.
</Note>

## Quick start (human or script)

```bash theme={null}
# 1. Get puzzle + token
curl https://api.anchorbrowser.io/v1/agent-access/challenge

# 2. Follow `next` and `challenge.prompt` from that response, then submit
curl -X POST https://api.anchorbrowser.io/v1/agent-access \
  -H "Content-Type: application/json" \
  -d '{"token":"<token from step 1>","answer":"42"}'
```

The POST response includes `api_key`. Use it as header `anchor-api-key` on all later requests.

## What the puzzle is

Each challenge is a multi-step problem. Use the challenge response — especially `next`, `challenge.prompt`, and `instructions` — then POST the final integer as `answer`.

Challenge data expires after **120 seconds** — if POST fails with an expired token, start again from step 1.

## If you are an autonomous agent

Treat Agent Access as a small state machine. **When a response includes `next`, call it.** When it does not, use the other fields in that same response.

```
GET /challenge  →  (follow next)  →  POST /  →  authenticated API (e.g. perform-web-task)
     ↑__________________ errors may send you back here __________________|
```

### Step 1 — Challenge

`GET /v1/agent-access/challenge` returns:

* `challenge.prompt` — the puzzle text
* `token` — pass this to POST (not the answer)
* `next` — when present, the next HTTP call before POST
* `instructions` — hints (`submit`, credit amounts, headers)

```json theme={null}
{
  "token": "eyJ...",
  "challenge": { "prompt": "..." },
  "next": {
    "method": "GET",
    "path": "/v1/agent-access/...",
    "description": "..."
  },
  "instructions": {
    "submit": "POST /v1/agent-access with { token, answer }",
    "anonymous_credits": 1,
    "identity_credits": 5
  }
}
```

### Step 2 — Submit (creates the key)

`POST /v1/agent-access` body:

```json theme={null}
{ "token": "<from challenge>", "answer": "<integer as string>" }
```

**Success** — you get the key plus `next` pointing at your first real API call:

```json theme={null}
{
  "api_key": "sk-...",
  "project_id": "...",
  "credits_granted": 1,
  "auth": {
    "api_key_header": "anchor-api-key",
    "identity_token_required": false
  },
  "next": {
    "method": "POST",
    "path": "/v1/tools/perform-web-task",
    "description": "You have an API key. Send header anchor-api-key ..."
  },
  "limits": { "session_max_duration_minutes": 60 }
}
```

**Error** — you get `error`, `next` (usually back to challenge), and `docs`:

```json theme={null}
{
  "error": "Incorrect answer",
  "next": {
    "method": "GET",
    "path": "/v1/agent-access/challenge",
    "description": "Get a fresh token, complete the challenge flow, then POST ..."
  },
  "docs": "https://docs.anchorbrowser.io/quickstart/agent-access"
}
```

### Optional — Guide endpoint

`GET /v1/agent-access` does **not** create a key. It returns credits, limits, a `flow` array (all steps), and `next` → challenge. Useful when an agent discovers Anchor cold and needs the full playbook in one response.

## Optional identity (1 → 5 credits)

Add `identity_token` on the **same POST** as `token` and `answer`:

* **No identity** — 1 credit, anonymous trial
* **OIDC JWT with verified email** — 5 credits; we know who you are

`identity_provider` is usually omitted — we detect the provider from the JWT `iss` claim (Google, GitHub Actions, Vercel). GitHub Actions tokens often have **no email**, so they still get 1 credit.

```bash theme={null}
curl -X POST https://api.anchorbrowser.io/v1/agent-access \
  -H "Content-Type: application/json" \
  -d '{"token":"<token>","answer":"<answer>","identity_token":"<OIDC JWT>"}'
```

If the POST response sets `auth.identity_token_required: true`, also send header `anchor-identity-token: <agent_identity_token>` on later API calls (value is in the POST response).

## After you have a key

```bash theme={null}
curl -X POST https://api.anchorbrowser.io/v1/tools/perform-web-task \
  -H "anchor-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Go to example.com and return the page title","url":"https://example.com"}'
```

Agent Access keys have a **60-minute** session cap. See [Perform Web Task](/agentic-browser-control/ai-task-completion) and [Create a Session](/quickstart/create-session).

## Endpoints

* `GET /v1/agent-access` — guide for agents (`next` → challenge). Does not issue a key.
* `GET /v1/agent-access/challenge` — puzzle + `token` + `instructions` + optional `next`
* `POST /v1/agent-access` — submit answer → `api_key` + `next`