# Authentication and API keys

> Authenticate Anytime Capital Payments API requests with a secret key as a Bearer token: create, store, rotate and revoke keys safely.

Source: https://anytime-capital.com/docs/authentication · Markdown: https://anytime-capital.com/docs/authentication.md · All docs: https://anytime-capital.com/docs/llms-full.txt

Every request to the API at `https://anytime-capital.com/api/v1` carries a secret key from **Settings → Developers** in your dashboard, sent as a Bearer token. Keys start with `ak_live_` and act for your business with full access to the API, so they belong on your server only.

**An authenticated request**

```bash
curl "https://anytime-capital.com/api/v1/payments?limit=1" \
  -H "Authorization: Bearer $ANYTIME_API_KEY"
```

## Create a key

1. Open **Settings → Developers** in the Anytime Capital dashboard. Owners and admins can create keys.
2. Choose **Create key** and name it after where it will be used, such as “Website backend” or “Claude”.
3. Copy the key straight away. It is shown once, in full, and never again: we keep only a hash of it.
4. Store it as a secret environment variable on your server, for example `ANYTIME_API_KEY`.

> **Keep keys on the server:** Never put a key in a browser, a mobile app, a public repository or a log. Anyone holding it can create payment links and invoices and read your payments and customers. If a key may have leaked, revoke it in Settings → Developers and create a new one.

## Who can use the API

The API is available once your business is verified and set up for card payments. Until then every request answers `403 NOT_ENROLLED`; finish verification in **Settings → Verification**.

## Managing keys

- A business can hold up to 10 active keys at once. Use one per integration so you can revoke one without touching the others.
- Settings → Developers lists each key by name, its first characters and last four, when it was created and when it was last used.
- Revoking a key takes effect immediately: requests with it fail with `401 UNAUTHORIZED`, exactly like an unknown key.
- To rotate a key, create the new one, deploy it, then revoke the old one.

## What a key does on your behalf

Everything a key creates is attributed to the team member who created the key, and every change it makes (creating a link or an invoice, sending an invoice, updating or deactivating a link) is written to your business's activity log with the key's name, so you can always see which integration did what.

## Authentication errors

| Status | Code | Meaning |
| --- | --- | --- |
| 401 | `UNAUTHORIZED` | The `Authorization` header is missing, or the key is malformed, unknown or revoked. |
| 403 | `NOT_ENROLLED` | The key is valid but the business isn't verified and set up for card payments yet. |
| 429 | `RATE_LIMITED` | The key went over its rate limit. See [Rate limits](https://anytime-capital.com/docs/rate-limits.md). |

## The same key works for AI tools

The MCP server at `https://anytime-capital.com/api/mcp` takes the same key in the same header, so Claude and other assistants act with exactly the access the REST API gives. See [Build with AI](https://anytime-capital.com/docs/build-with-ai.md).

---

Anytime Capital is a fintech company, not a bank. Payment processing, banking and payout services are provided by Anytime Capital's licensed partners. Rates shown are for US card payments; international cards, currency conversion and disputes may carry additional fees shown in your dashboard before you accept a payment.