The first thing the ARC-AGI-3 toolkit printed on a studio test machine was Got anonymous API key: a5fc7361-e0dc-4313-aff1-10d31ee9fe1c. Nobody asked for one. Nobody registered anything. Two lines later it had listed 25 environments, opened a scorecard, and downloaded a game.
So the practical question is not how to get an ARC-AGI-3 API key. It is what the one you already have can do, and what the registered kind adds.
How the toolkit gets an ARC-AGI-3 API key without asking
The logic is twelve lines in arc_agi/base.py. The constructor resolves a key in the usual order, constructor argument first, then the ARC_API_KEY environment variable, then an empty string. If the result is empty and the mode is anything other than OFFLINE, it calls _get_anonymous_api_key(), which is one unauthenticated request:
url = f"{self.arc_base_url}/api/games/anonkey"
response = requests.get(url, headers={"Accept": "application/json"}, timeout=10)The JSON that comes back has an api_key field, the toolkit logs it, logs You can register for an API key at https://three.arcprize.org, and from then on sends the value as an X-API-Key header on every call. It is a plain UUID. It lives for the process and is not written anywhere, so the next run gets a new one, and nothing you did under the old one is reachable again.
Two small things to know about it. It is printed in clear at INFO level, which is fine for a throwaway key and worth remembering before you paste a log somewhere with a registered one in it. And the header name is spelled two ways in the source, X-API-Key in the session setup and X-Api-Key in the per request path; HTTP headers are case insensitive so nothing breaks, but grep for both if you are proxying.
What an anonymous ARC-AGI-3 API key can do, measured
Everything the public toolkit does, as far as this machine could tell. With no registration at all, the anonymous key listed the 25 public environments in 1.21 seconds, fetched game metadata, downloaded ls20 and bp35 as source, and opened scorecards on the server, each with its own UUID. The first run and everything since ran on anonymous keys, including a survey that downloaded all 25 public games in one process, from a 777 line game to a 41,463 line one, and played 60,000 random actions against each. Nothing in that session was refused, throttled, or asked to identify itself.
What it did not do is anything that needs the server to remember you. The scorecards it opens are real, but they are tied to a key that will not exist tomorrow. That is the whole difference, and the documentation confirms it from the other side.
What a registered ARC-AGI-3 API key adds
The API keys page lists two benefits of registering: “Track your progress across games and sessions” and “Access the full list of games when launch goes out.” Registration is a login with Google or GitHub at arcprize.org/platform.
The first benefit is the one that matters day to day. A registered key gives your scorecards a home, so a run you did on Monday is still there on Friday and can be compared against one you did with a different harness. With an anonymous key, the local scorecard the toolkit computes is the only record you keep, which is fine for development and useless for a series.
The second benefit reads as a note from the launch period, when the public set was still being rolled out. Both keys see the same 25 public games today, and neither sees the semi private or fully private sets, which are never served by this API to anyone.
There is a third thing a registered key gives you that the API keys page does not mention, because it lives on the competition mode page. Appearing on the Unverified leaderboard requires COMPETITION mode, and competition mode runs everything through the API against one scorecard for all environments. A scorecard nobody can find again is not a leaderboard entry. If you want your number on that board, register first.
How the ARC-AGI-3 rate limit of 600 requests a minute bites
The rate limits page gives one number: “600 requests per minute (RPM)”. Go over it and you get a 429 with {"error":"RATE_LIMIT_EXCEEDED","message":"rate limit has been exceeded"}, and the toolkit backs off exponentially. The page does not say whether anonymous keys get a different limit, so assume they do not.
Six hundred a minute sounds generous until you remember what a request is. In ONLINE and COMPETITION modes every single action is a request, and an agent that presses keys as fast as it can, the way our random baseline did at 352,000 actions a second, would hit the ceiling in a tenth of a second. Ten actions a second is the sustainable rate, which for a human sized run of a few hundred actions per game is no constraint at all, and for a search based agent is the constraint.
The rate limit is also the clearest argument for the mode that needs no key. In NORMAL mode the toolkit downloads a game once and then steps it locally at whatever speed your CPU manages. Only the download and the scorecard calls go over the wire, and there are a handful of those per game, not per action.
When you need no ARC-AGI-3 API key at all
OFFLINE mode skips the anonymous key request entirely. The constructor sees an empty key, sees the mode, and does not make the call; on this machine it reported key: '' and finished in 0.00 seconds. Everything after that, play, scoring, recording, is local.
So the three tiers line up cleanly. No key: the 25 public games from disk, scored locally, no server state. Anonymous key: the same games, downloaded on demand, plus server scorecards that vanish with the process. Registered key: the same games again, with scorecards that persist and a path onto the unverified board.
None of the three changes what you can measure. The games that decide an agent’s real score are not on any tier of this API, and the key you hold only decides whether the server remembers how you did on the ones that are. For building a harness, that makes the anonymous key exactly as good as the registered one, and the offline mode better than both.