Authentication

Authenticate REST API calls with the access-token header, manage keys in the dashboard, and read auth errors.

Goal: send a valid key with every REST API call and know what each auth error means.

The header

Send your API key in the access-token header. It is not a Bearer token — Authorization: Bearer is not read.

curl -X POST "https://api.anysite.io/api/linkedin/user" \
  -H "access-token: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user": "satyanadella"}'

ACTION FOR THE HUMAN: copy your API key at https://app.anysite.io/billing — an agent cannot obtain it.

A request with no access-token header is rejected with 422 before anything is charged.

access-token is the REST API's only key header. The MCP server authenticates differently — a key in the URL, or an Authorization: Bearer header the client sends for you — so a working MCP setup says nothing about a REST call and the reverse: MCP authentication.

Where your keys live

Keys belong to a plan's balance and are managed in the dashboard on the Billing page.

ACTION FOR THE HUMAN: open https://app.anysite.io/billing (Open billing).

• Create a key. A plan's balance can hold up to 10 keys. All keys of one balance share its credits and rate limits — an extra key adds no credits, it only gives you a separate key per project.
• Delete a key. The key stops working immediately. The last key of a balance cannot be deleted.
• MCP plans. Their keys are not listed on the Billing page. The key is on the MCP page, where you can copy it along with the server URL: see MCP server.

See a key's value again

A key is never lost, and clicking its row only opens its details (id, limits) — not the key string. To read the value:

Open the Billing page

ACTION FOR THE HUMAN: open https://app.anysite.io/billing (Open billing).

Click Regenerate on the key's row

The circular-arrow icon on the row in the API keys list.

Confirm the dialog

The full key string is shown.

Despite its name, Regenerate does not change the key: it shows the same value the key already had, so clients already using it keep working. It therefore does not revoke a leaked key — to stop a key from working, delete it (after creating a replacement if it is the last key of the balance). Keys of MCP plans cannot be regenerated.

Verify

A call with your key returns a status other than 401, 403 or 422 from the table below. The x-token-points response header shows the credits left on the key's balance.

Auth errors

Error bodies have the shape {"detail": ...}. None of these responses is charged.

Status	detail	Meaning
422	list with "msg" naming a required header	The access-token header was missing.
401	"Invalid token"	The value is not an Anysite key (truncated, extra spaces, wrong string).
401	"Token does not exist"	The key was deleted.
401	"Token expired"	The plan the key belongs to has ended. Renew it on the Billing page.
401	"Points limit exhausted, required at least N points"	The balance has fewer credits than the call needs.
403	"This token is restricted to MCP usage only and cannot be used for direct API access"	The key belongs to an MCP-only plan.

The complete list of statuses is in Errors and limits.