> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

All API requests require a Bearer token in the `Authorization` header:

```http theme={null}
Authorization: Bearer {access_token}
```

***

**Quickstart: Access Token via Dashboard**

The fastest way to get started is to create a long-lived access token directly in the admin dashboard:

1. Go to [Organization Settings → API](https://app.anny.co/en-us/organization/settings/api)
2. Create a new access token and select the scopes you need
3. Copy the token and use it in your API requests

This is the recommended approach for server-side integrations and scripts.

**Integration Connectors**

For no-code/low-code integrations, anny provides native connectors for **Make.com** and **n8n**. These handle authentication automatically — no manual token management needed.

**OAuth2 Authorization Code Flow**

> [!NOTE]
>
> A custom OAuth2 Client ID is a special case. Contact [support@anny.co](mailto:support@anny.co) with your use case to request one.

For applications that need user-delegated access, anny supports the standard OAuth2 Authorization Code Flow (with optional PKCE for public clients).

**1. Authorization Request**

Redirect the user to the authorization endpoint:

```http theme={null}
https://auth.anny.co/oauth/authorize?client_id={client_id}&response_type=code&redirect_uri={redirect_uri}&state={random_state}&scope=
```

For **PKCE** (mobile/SPA apps), also include `code_challenge={challenge}&code_challenge_method=S256`.

After the user signs in, the **Authorization Request** screen lists the requested permissions and an optional **Organization access** control. The default is **All organizations**. Choosing one organization restricts the grant: the access token then includes a `tenant` claim with that organization's UUID, and refresh tokens keep the same restriction. Profile permissions still apply. Leave the default if the integration should not be limited to one organization.

**2. Code Exchange**

After the user authorizes, exchange the callback `code` for tokens:

```js theme={null}
const response = await fetch('https://auth.anny.co/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    client_id: '{client_id}',
    client_secret: '{client_secret}', // omit for PKCE
    code: '{authorization_code}',
    redirect_uri: '{redirect_uri}',
    grant_type: 'authorization_code',
    code_verifier: '{code_verifier}' // PKCE only
  })
})

const { access_token, refresh_token, expiresIn } = await response.json()
```

### Token Response

```json theme={null}
{
  "access_token": "eyJ...",
  "refresh_token": "def...",
  "expiresIn": 1440,
  "expiresAt": "2026-03-30T10:00:00+00:00"
}
```

Use `refresh_token` to obtain new access tokens before expiry.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.