---
title: "Create Agent Access project"
method: POST
path: "/v1/agent-access"
tags: ["Agent Access"]
---

# Create Agent Access project

`POST /v1/agent-access`

## Request

- Base URL: `https://api.anchorbrowser.io`
- URL: `https://api.anchorbrowser.io/v1/agent-access`
- Auth: none required

Issue an Agent Access API key. Submit the challenge `token` and computed integer `answer`
from GET /v1/agent-access/challenge. GET on this path returns a guide, not a key.
Optional `identity_token` as an OIDC JWT grants more credits. `identity_provider` is optional
when the JWT `iss` is Google (`https://accounts.google.com`), GitHub Actions
(`https://token.actions.githubusercontent.com`), or Vercel (`https://vercel.com`).
Returns `api_key` for header `anchor-api-key`.
Docs: https://docs.anchorbrowser.io/quickstart/agent-access

## Request body

- object
  - `token` string, required: Token returned by GET /v1/agent-access/challenge. Not the puzzle answer.
  - `answer` string, required: Final integer from the challenge prompt, as a string.
  - `identity_provider` string: Optional when identity_token is an OIDC JWT whose iss matches a known provider (google, github, or vercel). Required for opaque OAuth access tokens (google or github).
  - `identity_token` string: OIDC JWT preferred (iss auto-detected). GitHub Actions — GET $ACTIONS_ID_TOKEN_REQUEST_URL with Authorization bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN. Google — ID token JWT. Vercel — Sign in with Vercel user ID token (iss https://vercel.com). Opaque OAuth access tokens also work with identity_provider set.
  - `identity_audience` string: Optional. Pin the JWT aud claim. Omit unless you requested a specific aud.

## Response `200`

API key issued. Follow `next` to make an authenticated call.

- object
  - `api_key` string, required: API key for authenticated requests. Send as header anchor-api-key.
  - `project_id` string, required: Anchor project id created or reused for this onboarding.
  - `credits_granted` number, required: Credits added by this POST. 0 when the Agent Access project already existed for this owner.
  - `agent_identity_token` string: When present, send as header anchor-identity-token on later API calls when auth.identity_token_required is true.
  - `auth` object, required
    - `api_key_header` string, required: Header name for api_key (anchor-api-key).
    - `identity_token_header` string: Header name for agent_identity_token when identity_token_required is true.
    - `identity_token_required` boolean, required: When true, authenticated API calls must include anchor-identity-token in addition to anchor-api-key.
  - `upgrade` object
    - `message` string, required: How to repeat onboarding with identity_token to receive more credits.
  - `next` AgentAccessNextStep, required
    - `method` 'GET' | 'POST', required: HTTP method for the next call in the Agent Access onboarding flow.
    - `path` string, required: Path on https://api.anchorbrowser.io for the next call. Prepend the method to execute it.
    - `description` string, required: Plain-language instruction for what to do on the next call and what you receive afterward.
  - `docs` string, required: Human-readable guide URL for Agent Access.
  - `limits` object, required
    - `session_max_duration_minutes` number, required: Maximum session duration in minutes for keys issued through Agent Access.

## Other responses

- `400`: Missing token/answer, expired token, or incomplete identity fields. Follow `next`.
- `401`: Incorrect answer or invalid identity token. Follow `next`.
- `429`: Too many onboarding attempts from this source.
- `500`: Failed to create project.

## Changes

- **2026-10-16** `b3bfdb98c79e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api/changes/v1/agent-access/post.md)

---

[API](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api.md) - [All operations](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api/revisions/9d755f22df0e?raw)