The Anchorage Digital API performs authentication and authorization via a combination of:

• An API key, which is a bearer token
• A permission group signed by the user's organization, which is linked to the API key
• An Ed25519 Signature, which comes from a user-generated key and is required for certain requests

All API requests must be made over HTTPS and must include authentication using the following scheme.

API-Access-Key

An API key associated with a security role

Security Scheme Type: API Key
Header parameter name: Api-Access-Key

Host URLs

API URL's change depending on the organization's environment

• Production: https://api.anchorage.com/v2
• Staging: https://api.anchorage-staging.com/v2

Generating an API key

In order to make a valid API request, you must first create an API key. API keys can be created and managed in the Anchorage Digital Web Dashboard under the API 2.0 tab. When you create an API key, there are 3 pieces of information you will need to remember:

• API access key
• Ed25519 public key (optional for read-only requests)
• Ed25519 private/signing key (optional for read-only requests)

You must generate an Ed25519 signing key pair and save the public portion in the Anchorage Digital web dashboard when creating the API access key. The signing key pair is used for added security with sensitive requests.

The private key provides added security around sensitive requests as it is generated by the client and never shared with Anchorage. This key is used to authenticate sensitive requests against it's "public" key pair, which is stored by Anchorage. The private key cannot be derived from the public key stored by Anchorage's system.

❗️

Please note

Anchorage Digital cannot recover your API access key or private signing key if you forget them. You may generate a new access key and signing key at any time if you lose access.

API key permissions

Each API key is associated with a permission group. This permission group specifies the permitted actions for all associated API keys. Read more about permission groups here.

Generating a request

All requests must include the Api-Access-Key header, which contains your API access key as a string.

Endpoints that require a signature must include the Api-Signature and Api-Timestamp headers. Read more about signatures here.

All request bodies must be valid JSON and have the content type application/json.