Connect an integration with an API key

Connect an integration whose auth.kind is api_key. Anlyon first checks the key with the provider, with one read-only request to the integration’s own host. A key the provider accepts is stored as a secret of kind static with integrationId set, bound to the integration’s hosts and to request headers; those come from the integration and cannot be set here. A key the provider refuses is not stored (CONNECTION_KEY_REJECTED), and neither is one that could not be checked (CONNECTION_KEY_CHECK_FAILED). The key is never returned by any endpoint. The secret name must not exist yet in this environment. Counts toward the same limit of 10 per minute per workspace as connect sessions.

POST/api/v2/connections/keys

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Request body

requiredapplication/json

integrationIdstringrequired

max length 64 · matches ^[a-z0-9-]+$

secretNamestringrequired

The secret the key is stored as; actions reference it as {{secret:NAME}}.

min length 1 · max length 100 · matches ^[A-Z0-9_]+$

apiKeystringrequired

The key alone

min length 8 · max length 4096 · matches ^[\x21-\x7e]+$

descriptionstring

max length 500

Responses

201

Secret metadata returned; the value is never exposed.

successbooleanrequired

Allowed:true

dataSecretrequired

Secret metadata. The encrypted value is never exposed by any API.

Show properties

idstringrequired

namestringrequired

matches ^[A-Z0-9_]+$

descriptionstring | nullrequired

allowedHostsstring[] | nullrequired

Hosts this secret may be sent to. Null means any public host.

allowedPlacementsstring[] | nullrequired

Where in the request this secret may appear. Null means anywhere.

kindstringrequired

static holds a value you stored. connection is a connected account: its value is an access token fetched at dispatch, its hosts come from the integration, and it may only appear in a header. PUT cannot change a secret's kind.

Allowed:staticconnection

connectionobject | nullrequired

For a signed-in account, which integration it is and whether it still works. status mirrors health.status, which is the one record of it for both kinds of connected account. Null for a static secret, including one connected with an API key.

Show properties

integrationIdstringrequired

statusstringrequired

The same value as health.status. Reconnect the account to use it again.

Allowed:activeneeds_reauth

healthobject | nullrequired

Whether the connected account still works, whichever way it was connected. active, or needs_reauth with a reason once the provider refused the credential or the connector service could not refresh it. A dispatch that uses a needs_reauth account fails before anything is sent. Reconnect it with POST /api/v2/connections/{secretName}/reconnect. Null for a secret you stored directly, which Anlyon cannot check.

Show properties

statusstringrequired

Allowed:activeneeds_reauth

checkedAtstring<date-time> | nullrequired

When Anlyon last asked the provider whether the credential works. Null when it never has.

reasonstring | nullrequired

Set while status is needs_reauth. key_rejected: the provider refused the stored key. access_revoked: the provider no longer honours the signed-in account's grant. refresh_failed: the connector service could not refresh its token.

Allowed:key_rejectedaccess_revokedrefresh_failednull

integrationIdstring | nullrequired

The integration this secret was connected for, by signing in or with an API key. Null for a secret you stored directly. A secret connected with an API key is static with this set.

lastUsedAtstring<date-time> | nullrequired

createdAtstring<date-time>required

updatedAtstring<date-time>required

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

402

Payment Required - Usage quota exceeded

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

409

The request conflicts with current resource state or a concurrent decision.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

422

The provider did not accept the key (CONNECTION_KEY_REJECTED). Nothing was stored.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

429

Too Many Requests - Rate limit exceeded

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

502

The key could not be checked with the provider (CONNECTION_KEY_CHECK_FAILED). Nothing was stored.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.

Bodyapplication/json

integrationIdstring*secretNamestring*The secret the key is stored as; actions reference it as {{secret:NAME}}.apiKeystring*The key alonedescriptionstring

Request

curl -X POST 'https://api.anlyon.com/api/v2/connections/keys' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "integrationId": "github",
  "secretName": "GITHUB",
  "apiKey": "the-key-you-created-at-the-provider",
  "description": "string"
}'

const response = await fetch("https://api.anlyon.com/api/v2/connections/keys", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"integrationId\": \"github\",\n  \"secretName\": \"GITHUB\",\n  \"apiKey\": \"the-key-you-created-at-the-provider\",\n  \"description\": \"string\"\n}"
});

import requests

response = requests.post(
    "https://api.anlyon.com/api/v2/connections/keys",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"integrationId\": \"github\",\n  \"secretName\": \"GITHUB\",\n  \"apiKey\": \"the-key-you-created-at-the-provider\",\n  \"description\": \"string\"\n}",
)

Response

{
  "success": true,
  "data": {
    "id": "sec_01JABCDEF",
    "name": "string",
    "description": "string",
    "allowedHosts": [
      "string"
    ],
    "allowedPlacements": [
      "url"
    ],
    "kind": "static",
    "connection": {
      "integrationId": "hubspot",
      "status": "active"
    },
    "health": {
      "status": "active",
      "checkedAt": "2019-08-24T14:15:22Z",
      "reason": "key_rejected"
    },
    "integrationId": "github",
    "lastUsedAt": "2019-08-24T14:15:22Z",
    "createdAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z"
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "error": {
    "code": "QUOTA_EXCEEDED",
    "message": "Daily message quota exceeded. Upgrade your plan to continue."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}