Book a demo

Getting started

Authentication

Authenticate every request with your secret API key as a Bearer token.

Every API request carries your secret key in the Authorization header, as a Bearer token. There are no sessions, cookies or OAuth flows to set up.

Your keys

You get a sandbox key when you start a pilot, and a live key when you're ready to message real customers. Keep them the way you keep a database password:

  • Use them only from your server. Never put a key in a browser, a mobile app or a public repository.
  • Store them in a secret manager or an environment variable, such as ANYONEIN_KEY.
  • A key is at least 24 characters long. Send it exactly as issued, with no quotes.

Roadmap

Self-serve key management (creating, rotating and revoking keys in a dashboard) is on the roadmap. Until then, we issue and rotate keys for you. Ask us and we'll rotate a key the same working day.

Sending the key

Add the header to every request:

Header
Authorization: Bearer <your API key>

The key identifies your account. Confirmations you create with it are visible to every request made with the same key.

When authentication fails

A missing, malformed or wrong key gets a 401 with a plain-English message. Nothing is created or changed.

Check that:

  • the header is spelt Authorization and the value starts with Bearer (with one space);
  • you're using the sandbox key against the sandbox, and the live key against production;
  • no whitespace or line break crept in when the key was copied.

See Errors for every status code the API returns.

Webhook signing secret

Webhooks go the other way: AnyoneIn calls your server. They're signed with a separate webhook signing secret, issued with your keys, so you can check a request really came from us. See verifying signatures.

Base URL https://api.anyonein.co.uk/v1 is a placeholder until the production domain is confirmed. Found a mistake? Tell us.