Store an end user's API key

For an integration whose auth.kind is api_key: store the end user’s own key. It is checked first with the provider’s own read-only check when the catalogue has one; a key the provider refuses is not stored (CONNECTION_KEY_REJECTED). It is encrypted like a connected account’s token, replaces the end user’s previous key for the integration, and is never returned. No confirmation step: your server supplies the key. At most 10 keys per minute per end user.

PUT/api/v2/end-users/{endUserId}/connections/{integration}

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Path parameters

endUserIdstringrequired

Your own id for the end user. 1 to 128 characters of letters, digits and . _ : @ -. URL-encode it.

min length 1 · max length 128 · matches ^[A-Za-z0-9._:@-]{1,128}$

integrationstringrequired

A catalogue integration id, for example gmail or github.

matches ^[a-z][a-z0-9-]{0,63}$

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Anlyon-End-Userstring

The end user this call acts for: your own id for them, 1 to 128 characters of letters, digits and . _ : @ -. Accepted only with an API key, which stays on your server; a session or an OAuth token that sends it is refused. A key created with endUserRequired must send it on every action call (400 END_USER_REQUIRED). On an /end-users/{endUserId} route it must name the same end user as the path.

min length 1 · max length 128 · matches ^[A-Za-z0-9._:@-]{1,128}$

Request body

requiredapplication/json

tokenstring

The end user's own API key for the integration. Never returned.

min length 1 · max length 4096

fieldsConnectionFieldValues

For an integration whose auth.fields is set: each field by name, e.g. { "site": "acme", "email": "ana@acme.com", "apiToken": "..." }. Each value is checked against the integration's own pattern. The account field becomes the one host the key is bound to (acme.atlassian.net); the rest are stored encrypted together as one credential and never returned. Sent composed in the integration's header (HTTP Basic, or the provider's own header form).

Responses

200

The stored connection

successbooleanrequired

Allowed:true

dataEndUserConnectionrequired

Show properties

integrationstringrequired

kindstringrequired

Connected by signing in

Allowed:oauthapi_key

statusstringrequired

needs_reconnect once the provider refused the grant or a refresh failed for good. revoked is reserved: a disconnected account is deleted and not listed.

Allowed:activeneeds_reconnectrevoked

scopesstring[]required

What the provider says was granted. Empty for an API key.

connectedAtstring<date-time>required

updatedAtstring<date-time>required

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

How to get past this error, for a person or an agent. Present on refusals with a known next step, such as a missing scope or role, a plan or billing limit, a halted environment, or a missing secret, connected account, OAuth app or end-user header. Absent when there is no fix to give. Kept in production responses, unlike details.

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

422

The provider did not accept the key (CONNECTION_KEY_REJECTED). Nothing was stored.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

429

Too Many Requests - Rate limit exceeded. A workspace's API requests are limited per minute and per UTC clock hour by plan; Retry-After says when to try again, and an hourly refusal names the limit and when the count resets. Successful responses carry the same limits in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (the minute) and X-RateLimit-Limit-Hour, X-RateLimit-Remaining-Hour, X-RateLimit-Reset-Hour (the hour).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

502

The key could not be checked with the provider (CONNECTION_KEY_CHECK_FAILED). Nothing was stored.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.endUserIdpath*Your own id for the end user. 1 to 128 characters of letters, digits and `. _ : @ -`. URL-encode it.integrationpath*A catalogue integration id, for example `gmail` or `github`.Anlyon-End-UserheaderThe end user this call acts for: your own id for them, 1 to 128 characters of letters, digits and `. _ : @ -`. Accepted only with an API key, which stays on your server; a session or an OAuth token that sends it is refused. A key created with `endUserRequired` must send it on every action call (`400 END_USER_REQUIRED`). On an /end-users/{endUserId} route it must name the same end user as the path.

Bodyapplication/json

Request body

Request

curl -X PUT 'https://api.anlyon.com/api/v2/end-users/string/connections/string' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "string",
  "fields": {
    "property1": "string",
    "property2": "string"
  }
}'

const response = await fetch("https://api.anlyon.com/api/v2/end-users/string/connections/string", {
  method: "PUT",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"token\": \"string\",\n  \"fields\": {\n    \"property1\": \"string\",\n    \"property2\": \"string\"\n  }\n}"
});

import requests

response = requests.put(
    "https://api.anlyon.com/api/v2/end-users/string/connections/string",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"token\": \"string\",\n  \"fields\": {\n    \"property1\": \"string\",\n    \"property2\": \"string\"\n  }\n}",
)

Response

{
  "success": true,
  "data": {
    "integration": "gmail",
    "kind": "oauth",
    "status": "active",
    "scopes": [
      "string"
    ],
    "connectedAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z"
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}