API keys

Create a key

Open Settings, choose API credentials, and create a key with only the actions the integration needs. The raw secret is shown once; Anchor stores only its hash.

Send the key in the Authorization header:

Authorization: Bearer anchor_your_key
Accept: application/json

Keys can have a not-before time, expiry, and IP allowlist. Revoke a key immediately if it may have been exposed.

The credentials list supports server-side search, effective-availability
filtering, stable sorting, and opaque cursor pagination for accounts with many
integrations.

Permissions

• account:read reads the current account identity.
• anchor:read reads Anchor settings, Automations, Reminders, the shared birthday policy, and Notifications.
• anchor:manage manages settings, Automations, Reminders, the shared birthday policy, and Notification actions.
• notifications:create creates complete notifications directly.

Use anchor:manage when an external application needs Anchor to own a schedule.
Use notifications:create when the application already owns timing and can
send the notification content and optional delivery policy itself.
The notifications:create action does not grant access to Reminder definitions or the birthday policy.

API reference

Open the API Docs link in the public navigation for the deployed Swagger UI. It documents the complete API-key surface, authorization requirements, Problem Details errors, and schemas.