Authentication
Every request carries your ak_ API key as a bearer token — issued from the dashboard, non-expiring, server-side only.
Every request carries your API key as a bearer token. Keys are issued from the LinkToAny
dashboard, are prefixed ak_, and do not expire — keep them server-side, never in browser
code.
1. Send your API key on every request
authorization: Bearer ak_<your_api_key>
accept: application/jsonimport { LinkToAny } from '@linktoany/sdk';
const client = new LinkToAny({
apiKey: process.env.LINKTOANY_API_KEY, // your ak_… key
environment: 'prod', // 'prod' (default) | 'dev' (staging)
organisationId: process.env.LINKTOANY_ORG_ID, // optional tenant context
timeoutMs: 30_000, // per-request timeout (default 30s)
maxRetries: 2, // retries on 429/502/503/504 (default 2)
});Use an admin key for writes and a public key for read-only access.
2. Make your first call
curl --location --request GET \
"https://api.linktoany.com/unified/{accountId}/category?pageSize=10" \
--header "accept: application/json" \
--header "authorization: Bearer ak_<your_api_key>"import { LinkToAny } from '@linktoany/sdk';
const client = new LinkToAny({ apiKey: process.env.LINKTOANY_API_KEY });
const page = await client.records.list(accountId, 'category', { pageSize: 10 });
console.log(page.data);{
"success": true,
"data": [
{ "externalId": "cat_burgers", "name": "Burgers & Sandwiches", "active": true }
]
}Treat the key like a password
It grants full access to every connected account in your organisation. Rotate it from the dashboard if it is ever exposed; the previous key stops working as soon as rotation completes.