API authentication

AskAnyDocs uses API keys for the external team API.

How authentication works

The external API expects a bearer token in the Authorization header:

Authorization: Bearer YOUR_API_TOKEN

If the header is missing, empty, or invalid, the API returns:

{
  "message": "Unauthorized"
}

with HTTP status 401.

Generate a key

Create the token in the AskAnyDocs dashboard under the API keys section.

The token belongs to the current team. All external API responses are scoped to that team.

Example request

curl -X GET "https://app.askanydocs.com/api/external/bots" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Accept: application/json"

Team scoping

The bearer token is resolved to an active API token record. Once validated, the API only returns bots, conversations, and messages for that token's team.

Security recommendations

• treat the token as a secret
• keep separate keys for production and development
• rotate keys if they are exposed
• do not embed team API keys into browser code

Scope

This page covers only the external API under /api/external.

Related articles