Authentication
All authenticated customer endpoints accept a Prism API key as a Bearer token:
X-API-Key is not a supported customer authentication method. Public examples
and integrations should always use Authorization: Bearer.
Key lifecycle
- Create a key in the developer console.
- Store the full secret immediately. Prism reveals it only once.
- Send it only from a trusted server environment.
- Create a replacement before rotating an active integration.
- Revoke the old key after the replacement is deployed.
Prism stores a one-way key hash and a short lookup prefix. The full secret
cannot be recovered from the console or database.
Environment variables
Keep the key outside source control:
For deployed services, use the secret manager provided by your hosting
platform. Use a separate key for each service or employee integration so that
you can revoke access without interrupting unrelated workloads.
Policy attached to a key
A key can be restricted by:
- route scope:
chat, embeddings, image, or video
- model allowlist
- rate limits
- organization budget and available credits
- welcome-credit trial policy
GET /v1/models returns only the models the current key may discover. A model
can still become unavailable later if an administrator changes policy.
Current self-service organization offboarding does not automatically invalidate
an existing key. An administrator must revoke the departing person’s key.
Authentication failures
Prism returns 401 when the Bearer token is missing, malformed, unknown, or
revoked. Do not retry a 401 with the same key. Replace the key or correct the
server configuration.
อ่านภาษาไทย