Authentication

Every request to https://api.prismareviews.com/v1 needs an API key in the Authorization header, as a Bearer token. There are two kinds of keys: live keys (pk_live_…) for real platforms and test keys (pk_test_…) for sample data.

curl https://api.prismareviews.com/v1/usage \
  -H "Authorization: Bearer $PRISMA_API_KEY"

const res = await fetch("https://api.prismareviews.com/v1/usage", {
  headers: { Authorization: "Bearer " + process.env.PRISMA_API_KEY },
});
console.log(await res.json());

import os
import requests

resp = requests.get(
    "https://api.prismareviews.com/v1/usage",
    headers={"Authorization": f"Bearer {os.environ['PRISMA_API_KEY']}"},
    timeout=30,
)
print(resp.json())

API keys

• A key belongs to one workspace. Everything it creates (connections, locations, reviews, webhooks) belongs to that workspace.
• Keys look like pk_live_ or pk_test_ followed by a random string. Prisma stores only a SHA-256 hash of each key, so a lost key can’t be recovered: you get a new one.
• You get your keys when you create an account confirm your email and answer four short questions: your workspace then gets one live key and one test key, shown in full once. After that, the dashboard only shows each key’s prefix, and you can roll or revoke each key there.
• To replace a key, or to revoke one you think was exposed, click Roll next to it in the dashboard. Prisma creates a new key, shows it once, and the old key stops working at once (requests with it get invalid_api_key).
• Keep keys on your server, in an environment variable such as PRISMA_API_KEY. Never ship them in a browser, a mobile app or a public repository.

Live and test mode

The prefix of the key decides the mode of every request:

Test and live data never mix: a test key never sees live connections, locations or reviews, and a live key never sees test ones. Asking for an object of the other mode returns 404 resource_not_found.

Two things are shared by both modes in a workspace: webhook endpoints (see Webhooks) and the monthly request counters in Usage.

Rate limit headers

Every authenticated response includes:

The limit is per key and counted in fixed one-minute windows. Requests over the limit are not counted in your usage.

Authentication errors

{
  "error": {
    "type": "authentication_error",
    "code": "invalid_api_key",
    "message": "This API key does not exist or was revoked.",
    "retryable": false,
    "request_id": "req_01KJ8T3C5D7E9F1G3H5J7K9M1N",
    "docs_url": "https://prismareviews.com/docs/errors#invalid_api_key"
  }
}

All codes are on Errors. How Prisma protects keys and platform tokens is on Security.