The first thing the ARC-AGI-3 toolkit printed on our test machine was Got anonymous API key: a5fc7361-e0dc-4313-aff1-10d31ee9fe1c. Nobody asked for one. Nobody registered anything. Two lines later it had listed 25 environments, opened a scorecard, and downloaded a game.
So the practical question is not how to get an ARC-AGI-3 API key. It is what the one you already have can do, and what the registered kind adds. For a team setting up agent evaluation, it also decides who keeps the results.
How the toolkit gets an ARC-AGI-3 API key without asking
The logic is twelve lines in arc_agi/base.py. The constructor resolves a key in the usual order, constructor argument first, then the ARC_API_KEY environment variable, then an empty string. If the result is empty and the mode is anything other than OFFLINE, it calls _get_anonymous_api_key(), which is one unauthenticated request:
url = f"{self.arc_base_url}/api/games/anonkey"
response = requests.get(url, headers={"Accept": "application/json"}, timeout=10)The JSON that comes back has an api_key field, the toolkit logs it, logs You can register for an API key at https://three.arcprize.org, and from then on sends the value as an X-API-Key header on every call. It is a plain UUID. It lives for the process and is not written anywhere, so the next run gets a new one, and nothing you did under the old one is reachable again.
Two small things to know about it. It is printed in clear at INFO level, which is fine for a throwaway key and worth remembering before you paste a log somewhere with a registered one in it. And the header name is spelled two ways in the source, X-API-Key in the session setup and X-Api-Key in the per request path; HTTP headers are case insensitive so nothing breaks, but grep for both if you are proxying.
What an anonymous ARC-AGI-3 API key can do, measured
Everything the public toolkit does, as far as this machine could tell. With no registration at all, the anonymous key listed the 25 public environments in 1.21 seconds, fetched game metadata, downloaded ls20 and bp35 as source, and opened scorecards on the server, each with its own UUID. The first run and everything since ran on anonymous keys, including a survey that downloaded all 25 public games in one process, from a 777 line game to a 41,463 line one, and played 60,000 random actions against each. Nothing in that session was refused, throttled, or asked to identify itself.
What it did not do is anything that needs the server to remember you. The scorecards it opens are real, but they are tied to a key that will not exist tomorrow. That is the whole difference, and the documentation confirms it from the other side.
What a registered ARC-AGI-3 API key adds
The API keys page lists two benefits of registering: “Track your progress across games and sessions” and “Access the full list of games when launch goes out.” Registration is a login with Google or GitHub at arcprize.org/platform.
The first benefit is the one that matters day to day. A registered key gives your scorecards a home, so a run you did on Monday is still there on Friday and can be compared against one you did with a different harness. With an anonymous key, the local scorecard the toolkit computes is the only record you keep, which is fine for development and useless for a series.
The second benefit reads as a note from the launch period, when the public set was still being rolled out. Both keys see the same 25 public games today, and neither sees the semi private or fully private sets, which are never served by this API to anyone.
There is a third thing a registered key gives you that the API keys page does not mention, because it lives on the competition mode page. Appearing on the Unverified leaderboard requires COMPETITION mode, and competition mode runs everything through the API against one scorecard for all environments. A scorecard nobody can find again is not a leaderboard entry. If you want your number on that board, register first.
How the ARC-AGI-3 rate limit of 600 requests a minute bites
The rate limits page gives one number: “600 requests per minute (RPM)”. Go over it and you get a 429 with {"error":"RATE_LIMIT_EXCEEDED","message":"rate limit has been exceeded"}, and the toolkit backs off exponentially. The page does not say whether anonymous keys get a different limit, so assume they do not.
Six hundred a minute sounds generous until you remember what a request is. In ONLINE and COMPETITION modes every single action is a request, and an agent that presses keys as fast as it can, the way our random baseline did at 352,000 actions a second, would hit the ceiling in a tenth of a second. Ten actions a second is the sustainable rate, which for a human sized run of a few hundred actions per game is no constraint at all, and for a search based agent is the constraint.
The rate limit is also the clearest argument for the mode that needs no key. In NORMAL mode the toolkit downloads a game once and then steps it locally at whatever speed your CPU manages. Only the download and the scorecard calls go over the wire, and there are a handful of those per game, not per action.
Does a team need a registered ARC-AGI-3 API key, and what does it cost?
On ARC Prize’s own published terms, it costs nothing. The rate limits page, read on 17 October 2026, says the API “is currently free to use during its research preview” and is supported on a best-effort basis, with no formal SLA, uptime guarantee or guaranteed response times. The API keys page, read the same day, lists no price for registering. So the decision is not about money. It is about which records a team has to keep, and how much of its work it wants to rest on a service with no service level.
A team that only builds and tests agents needs no registered key. The agent itself, the loop that the 40 line ARC-AGI-3 agent guide walks through line by line, runs the same on an anonymous key as in offline mode, and offline mode keeps day to day work off a best-effort service altogether. A team that has to compare runs across weeks, show results to a client or a manager, or appear on the Unverified leaderboard needs a registered key, because only a registered key gives server scorecards a home.
Two practical points before registering. Decide who owns the key. Keys are created in a user profile after a Google or GitHub login, so a key made by one engineer sits in that person’s account, and the scorecard history sits with it. And treat logs as sensitive once a registered key is in use, since the toolkit prints the key in clear at INFO level, as the first section of this piece shows. The published limit of 600 requests a minute, about ten actions a second, is no constraint on a model-backed agent and a hard one on a search agent run online, which is a reason to run search in NORMAL or OFFLINE mode and keep the API for the scorecard.
When you need no ARC-AGI-3 API key at all
OFFLINE mode skips the anonymous key request entirely. The constructor sees an empty key, sees the mode, and does not make the call; on this machine it reported key: '' and finished in 0.00 seconds. Everything after that, play, scoring, recording, is local.
So the three tiers line up cleanly. No key: the 25 public games from disk, scored locally, no server state. Anonymous key: the same games, downloaded on demand, plus server scorecards that vanish with the process. Registered key: the same games again, with scorecards that persist and a path onto the unverified board.
None of the three changes what you can measure. The games that decide an agent’s real score are not on any tier of this API, and the key you hold only decides whether the server remembers how you did on the ones that are. For building a harness, that makes the anonymous key exactly as good as the registered one, and the offline mode better than both. If you would rather not use a key at all, offline mode runs the games without one, and a scorecard can be scored locally.
In this series: ARC-AGI-3 agent toolkit
