> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prismgateway.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, send, rotate, and revoke Prism API keys safely

# Authentication

All authenticated customer endpoints accept a Prism API key as a Bearer token:

```http theme={null}
Authorization: Bearer sk-prism-...
```

`X-API-Key` is not a supported customer authentication method. Public examples
and integrations should always use `Authorization: Bearer`.

## Key lifecycle

1. Create a key in the developer console.
2. Store the full secret immediately. Prism reveals it only once.
3. Send it only from a trusted server environment.
4. Create a replacement before rotating an active integration.
5. Revoke the old key after the replacement is deployed.

Prism stores a one-way key hash and a short lookup prefix. The full secret
cannot be recovered from the console or database.

## Environment variables

Keep the key outside source control:

```bash theme={null}
export PRISM_API_KEY="sk-prism-..."
```

For deployed services, use the secret manager provided by your hosting
platform. Use a separate key for each service or employee integration so that
you can revoke access without interrupting unrelated workloads.

## Policy attached to a key

A key can be restricted by:

* route scope: `chat`, `embeddings`, `image`, or `video`
* model allowlist
* rate limits
* organization budget and available credits
* welcome-credit trial policy

`GET /v1/models` returns only the models the current key may discover. A model
can still become unavailable later if an administrator changes policy.

<Warning>
  Current self-service organization offboarding does not automatically invalidate
  an existing key. An administrator must revoke the departing person's key.
</Warning>

## Authentication failures

Prism returns `401` when the Bearer token is missing, malformed, unknown, or
revoked. Do not retry a `401` with the same key. Replace the key or correct the
server configuration.

[อ่านภาษาไทย](/th/authentication)