Authentication & Access
Public access
Understand Antly anonymous access for public forms, careers, storefront, payment links, webchat, and public pages.
public means anonymous product access. It is used only for controllers and model intents that Antly explicitly exposes without a logged-in user.
Public access is not a substitute for API keys. If you have a secret token and a server integration, use api_key. If a browser visitor is not logged in and is using a published product surface, use the public controllers for that surface.
Public surfaces
Antly exposes these common anonymous surfaces:
- Public object forms at
/form/<code>, backed byobjects.PublicObjectcontrollers. - ATS careers pages and application submission controllers.
- Public customer-site pages through the
sites.Page.retrieve_public_pagecontroller. - Public storefront reads and checkout actions for ShopByAntly.
- Hosted invoice payment and verification flows.
- Webchat configuration, token request, token verification, send, and message retrieval controllers.
Each controller resolves tenant and product configuration before it returns data. Public object forms, for example, still require the object to be published for public use and may enforce submission caps.
Public JQL example
1{
2 "__meta__": {
3 "schema": "controller",
4 "namespace": "objects.PublicObject",
5 "intent": "retrieve_public_form",
6 "authenticationClass": "public",
7 "return": {
8 "id": null,
9 "name": null,
10 "formSchema": null
11 }
12 },
13 "code": "contact-us"
14}Controller intent names vary by surface, so prefer the published embed URL or the surface-specific guide when possible. See /developer/embed-public-forms, /developer/embed-careers, /developer/payment-links, and /developer/embed-webchat.
Safety rules
Do not include JqlToken values in public pages. Do not expose broad model::*.*::* access to anonymous traffic. Do not assume that a public request can call normal model CRUD just because the visitor can see a form.
When a public flow needs to create data, use the product controller for that flow. When a private service needs to create data, use an API application.