Skip to main content

​
Authentication

All authenticated customer endpoints accept a Prism API key as a Bearer token:
X-API-Key is not a supported customer authentication method. Public examples and integrations should always use Authorization: Bearer.

​
Key lifecycle

  1. Create a key in the developer console.
  2. Store the full secret immediately. Prism reveals it only once.
  3. Send it only from a trusted server environment.
  4. Create a replacement before rotating an active integration.
  5. Revoke the old key after the replacement is deployed.
Prism stores a one-way key hash and a short lookup prefix. The full secret cannot be recovered from the console or database.

​
Environment variables

Keep the key outside source control:
For deployed services, use the secret manager provided by your hosting platform. Use a separate key for each service or employee integration so that you can revoke access without interrupting unrelated workloads.

​
Policy attached to a key

A key can be restricted by:
  • route scope: chat, embeddings, image, or video
  • model allowlist
  • rate limits
  • organization budget and available credits
  • welcome-credit trial policy
GET /v1/models returns only the models the current key may discover. A model can still become unavailable later if an administrator changes policy.
Current self-service organization offboarding does not automatically invalidate an existing key. An administrator must revoke the departing person’s key.

​
Authentication failures

Prism returns 401 when the Bearer token is missing, malformed, unknown, or revoked. Do not retry a 401 with the same key. Replace the key or correct the server configuration. อ่านภาษาไทย