All API requests authenticate with a Bearer token — either a workspace API key (ays_live_…) or an OAuth access token (ays_oauth_…) from the CLI device flow:
curl https://anysola.com/api/agents \
-H "Authorization: Bearer YOUR_TOKEN"
Workspace API keys
Create and revoke keys under Dashboard → Settings → API keys. The plaintext key is shown once at creation — store it in your secret manager immediately. Keys are stored server-side only as hashes and cannot be recovered; if a key is lost, revoke it and create a new one.
API keys are scoped to the workspace that created them and carry full workspace access (suitable for CI and server automation).
Failure modes
| Response | Meaning |
|---|---|
401 Unauthorized |
Missing, malformed, or revoked token |
403 Forbidden |
Token is valid but lacks scope or role for the action |
402 Payment Required |
Token is valid but the plan blocks the action (agent or quota limit) |
429 Too Many Requests |
Rate limit hit — respect Retry-After |
Rotate keys on a schedule and immediately after personnel changes — revocation is instant.