Skip to content

Issue and Rotate AnyType API Key

This runbook governs creation, rotation, and revocation of AnyType Local API keys per SPB-02..SPB-08.

Issuance

  1. Open AnyType desktop → Settings → API Keys.
  2. Click New API Key, enter purpose label (e.g., cursor-pkm-skills).
  3. Approve the 4-digit challenge in the desktop app.
  4. Copy the generated bearer token.
  5. Store in user-only secret store at the documented path; never inside this workspace, never in any chat, never in any agent runtime mount. The agent does not read this path (SPB-03).
  6. For Cursor MCP: build the OPENAPI_MCP_HEADERS JSON the server expects (see Anytype MCP), e.g. {"Authorization":"Bearer <key>","Anytype-Version":"<date from API changelog>"}, and export it as ANYTYPE_OPENAPI_MCP_HEADERS for ${env:ANYTYPE_OPENAPI_MCP_HEADERS} in .cursor/mcp.json. Or use npx -y @anyproto/anytype-mcp get-key and paste only into env, never the repo.
  7. Provision a separate labeled key per integration (Cursor vs scripts vs home lab) — see "Agent-scoped key" below.

Agent-scoped key

We do not hand the user-level key to agents. Instead:

  • Generate a separate AnyType API Key per integration (one for cursor-mcp, one for pkm-skills-batch, etc.).
  • Each key has a label and is documented in this runbook.
  • Agent runtimes get only their assigned key, injected at runtime — never written to disk in the workspace.
  • Revoke immediately if any leakage suspected (SPB-08).

Rotation

  • Default cadence: every 90 days.
  • Triggered rotation: on any incident, suspected leak, agent misuse, or change of laptop.
  • Procedure:
  • Mint a new key in AnyType for the same integration label.
  • Update the runtime injection (env var, secret manager, etc.).
  • Verify the integration works on the new key.
  • Revoke the old key in AnyType.
  • Append an entry to audit-log.md.

Revocation

  • Open AnyType desktop → Settings → API Keys.
  • Click revoke on the labeled key.
  • Append entry to audit-log.md.
  • If the revoked key was tied to an agent integration, halt that agent until a new key is issued.

What goes into the audit log

  • Date.
  • Action (issued / rotated / revoked).
  • Integration label.
  • Reason (e.g., scheduled rotation, incident response, key compromised).
  • Reviewer / actor.

Reference