---
title: "Anonymous Provision"
method: POST
path: "/api/auth/anonymous/provision"
tags: ["Authentication"]
---

# Anonymous Provision

`POST /api/auth/anonymous/provision`

## Request

- Base URL: `https://api.agentstack.tech` (the document declares no server; this is the origin it was published from)
- URL: `https://api.agentstack.tech/api/auth/anonymous/provision`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Provision an anonymous player for a hosted project SPA (ArcaneStack).

Gene: ``core.auth.anonymous_provisioning.gen1``

Body: ``{ "project_id": int }``
Optional header: ``X-Anon-Bootstrap-Key`` — must match ``ANON_BOOTSTRAP_KEY`` or
``OAUTH_ECOSYSTEM_API_KEY`` when those env vars are set. If neither env is set,
the header is optional (dev-only).

Returns ``api_key``, ``user_id``, ``access_token`` (HS256 JWT for Stream Relay),
``refresh_token``, ``is_anonymous``, ``project_id``.

## Headers

- `Idempotency-Key` string

## Response `200`

Successful Response

- unknown

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/agentstack/apis/agentstack-core-api.md) · [All operations](https://skmtc.dev/agentstack/apis/agentstack-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentstack/apis/agentstack-core-api/revisions/8ecf3406e74a?raw)