---
title: "Create Challenge"
method: POST
path: "/v1/auth/challenges"
tags: ["Auth"]
---

# Create Challenge

`POST /v1/auth/challenges`

Generates a one-time authentication challenge for granting API access to the user's vault. Upon providing a valid `app_name`, the server issues a unique `challenge_id` and displays a 4-digit code within the Anytype Desktop. The `challenge_id` must then be used with the `/v1/auth/api_keys` endpoint to solve the challenge and retrieve an authentication token. This mechanism ensures that only trusted applications and authorized users gain access.

## Headers

- `Anytype-Version` string, required

## Request body

- CreateChallengeRequest
  - `app_name` string — The name of the app that is requesting the challenge

## Response `201`

The challenge ID associated with the started challenge

- CreateChallengeResponse
  - `challenge_id` string — The challenge id associated with the displayed code and needed to solve the challenge for api_key

## Other responses

- `400` — Bad request
- `500` — Internal server error

## Changes

- **2026-01-07** `f701c48d380c` — 1 breaking, 1 warning, 1 info
  - request body became required
  - deleted the `query` request parameter `app_name`
  - added the new optional request property `app_name`
- **2025-05-18** `65011ed70b4c` — 1 info
  - endpoint added
- **2025-05-16** `3c9aa276aecb` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/anyproto/apis/anytype-api/changes/v1/auth/challenges/post.md)

---

[API](https://skmtc.dev/anyproto/apis/anytype-api.md) · [All operations](https://skmtc.dev/anyproto/apis/anytype-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/anyproto/anytype-api/revisions/6f8ebf2b819a/schema)