> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anyway.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use Merchant API keys, Agent Wallet signatures, and telemetry keys safely.

## Merchant API key

Create a **Merchant API key** under **Business profile → Developers → API Keys**.

```bash theme={null}
curl https://merchant-api-prod.anyway.sh/v1/me \
  -H "X-API-Key: ak_YOUR_API_KEY"
```

`GET /v1/me` returns the key's `orgId`, `apiKeyId`, and permissions. Merchant API keys are server-side credentials.

## Agent Wallet Key

An Agent Wallet Key is a P-256 signing bundle created for one agent wallet:

```bash theme={null}
export ANYWAY_AGENT_WALLET_KEY="<base64url key bundle>"
anyway wallets agents whoami
```

The CLI signs each Agent Wallet API request. Advanced direct clients send:

| Header              | Value                        |
| ------------------- | ---------------------------- |
| `X-Agent-Pubkey`    | Base64 SPKI P-256 public key |
| `X-Agent-Timestamp` | Current Unix timestamp       |
| `X-Agent-Signature` | Base64 DER ECDSA signature   |

The signature covers the SHA-256 digest of:

```text theme={null}
METHOD
/request/path
unix_timestamp
```

Prefer the CLI unless you specifically need to implement this protocol.

## Telemetry key

Agent Traces API keys authorize SDK export to the collector. Store them in environment variables or a secrets manager and redact them from spans.

<Warning>
  Never expose any secret in browser code, public source, model prompts, traces, screenshots, or support messages. Rotate a key immediately if its value may have leaked.
</Warning>