> ## Documentation Index
> Fetch the complete documentation index at: https://docs.graphy.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Keyless access

Try the API with no signup and no key. Send a request without an `Authorization` header and we mint a token for you, serve that same request, and hand the token back in a response header.

<Note>Keyless is for trying things out. For anything you depend on, [create an API key](/agents/api-keys): the limits are higher and the budget is yours alone.</Note>

## Your first call

```bash theme={null}
curl -i -N https://agents.graphy.dev/api/v0/evaluate \
  -H "Content-Type: application/json" \
  -d '{
    "config": {
      "data": {
        "columns": [
          { "key": "month", "label": "Month" },
          { "key": "sales", "label": "Sales" }
        ],
        "rows": [
          { "month": "Jan", "sales": 10 },
          { "month": "Feb", "sales": 20 }
        ]
      }
    }
  }'
```

The `-i` matters. Your token is in the response headers:

```http theme={null}
HTTP/1.1 200 OK
content-type: text/event-stream
x-graphy-anonymous-token: graphy_9lOx1t-kPLChHCBunWEt8TQGeG9kzZADlRT7m0Ik83g
x-ratelimit-limit: 100
x-ratelimit-remaining: 99
```

## Keep the token

Save it and send it as a normal Bearer token from then on. Every call that carries it reuses the same budget instead of minting again.

```bash theme={null}
curl -N https://agents.graphy.dev/api/v0/evaluate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer graphy_9lOx1t-..." \
  -d '{ "config": { "data": { "columns": [], "rows": [] } } }'
```

<Warning>If you throw the token away and call again, you get a new one. That is capped at **10 new tokens per hour** from one network, so a script that forgets its token will start failing. Store it.</Warning>

## What you get

|                | Keyless | With an API key |
| -------------- | ------- | --------------- |
| Monthly budget | \$5     | \$15            |
| Requests       | 100/min | 100/min         |
| Signup         | none    | required        |

Keyless also shares a pool with everyone else trying the API, so a busy day can run it out. An API key does not share.

## Which endpoints work

<Check>`generate`, `mutate`, `pipeline`, `explore`, `extract`, `annotate`, `narrate`, `evaluate`, `chart-knowledge`</Check>

<Icon icon="xmark" /> `judge`, `suggestions`, `generate-workflow`, `feedback` and all attachment endpoints need an API key.

## Errors

| Status | Code                          | What to do                                                                |
| ------ | ----------------------------- | ------------------------------------------------------------------------- |
| 429    | `ANONYMOUS_CAPACITY_EXCEEDED` | Free access is out of budget for now. Try tomorrow or use an API key      |
| 429    | `QUOTA_EXCEEDED`              | Your token spent its \$5 this month. Wait for the reset or use an API key |
| 429    | `RATE_LIMIT_ERROR`            | Too fast. Wait the number of seconds in `Retry-After`                     |
| 403    | `ANONYMOUS_ACCESS_FORBIDDEN`  | That endpoint needs an API key                                            |
| 503    | `ANONYMOUS_MINT_UNAVAILABLE`  | We could not issue a token. Retry, and tell us if it persists             |

None of the 4xx ones are worth retrying immediately. Wait, or switch to a key.

## Browser use

The token header is exposed to JavaScript, so a browser client can read it:

```js theme={null}
const response = await fetch('https://agents.graphy.dev/api/v0/evaluate', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ config: { data } }),
});

const token = response.headers.get('X-Graphy-Anonymous-Token');
if (token) {
  localStorage.setItem('graphy_token', token);
}
```

<Warning>A keyless token is a bearer credential. Anything on the page can read it out of `localStorage`, and it does not expire. Treat it as throwaway, and never put a real API key in a browser.</Warning>