<!-- Reviews API Authentication: API Keys and Test Mode · Prisma · https://prismareviews.com/docs/api-reference/authentication -->
> How to authenticate with the Prisma reviews API: Bearer API keys, live and test keys, rate limit headers and the 401 errors you can get.

# Authentication

Every request to `https://api.prismareviews.com/v1` needs an API key in the `Authorization` header, as a Bearer token. There are two kinds of keys: live keys (`pk_live_…`) for real platforms and test keys (`pk_test_…`) for sample data.

```bash
curl https://api.prismareviews.com/v1/usage \
  -H "Authorization: Bearer $PRISMA_API_KEY"
```
```javascript
const res = await fetch("https://api.prismareviews.com/v1/usage", {
  headers: { Authorization: "Bearer " + process.env.PRISMA_API_KEY },
});
console.log(await res.json());
```
```python
import os
import requests

resp = requests.get(
    "https://api.prismareviews.com/v1/usage",
    headers={"Authorization": f"Bearer {os.environ['PRISMA_API_KEY']}"},
    timeout=30,
)
print(resp.json())
```

## API keys

- A key belongs to one workspace. Everything it creates (connections, locations, reviews, webhooks) belongs to that workspace.
- Keys look like `pk_live_` or `pk_test_` followed by a random string. Prisma stores only a SHA-256 hash of each key, so a lost key can't be recovered: you get a new one.
- You get your keys when you [create an account](https://app.prismareviews.com/signup) confirm your email and answer four short questions: your workspace then gets one live key and one test key, shown in full once. After that, the [dashboard](https://app.prismareviews.com/api-keys) only shows each key's prefix, and you can roll or revoke each key there.
- To replace a key, or to revoke one you think was exposed, click **Roll** next to it in the dashboard. Prisma creates a new key, shows it once, and the old key stops working at once (requests with it get `invalid_api_key`).
- Keep keys on your server, in an environment variable such as `PRISMA_API_KEY`. Never ship them in a browser, a mobile app or a public repository.

## Live and test mode

The prefix of the key decides the mode of every request:

| | Live key `pk_live_…` | Test key `pk_test_…` |
| --- | --- | --- |
| Connections | Real OAuth, credentials or listing URLs | Any platform, no credentials needed, active at once |
| Locations | Your real locations and apps | Two sample locations per connection |
| Reviews | Real reviews from the platform | Five sample reviews per location |
| Replies | Published on the platform (read-only platforms return `422 reply_not_supported`) | Accepted, never published anywhere |
| Plan limits | Apply | Apply (locations and platforms included in your plan) |

Test and live data never mix: a test key never sees live connections, locations or reviews, and a live key never sees test ones. Asking for an object of the other mode returns `404 resource_not_found`.

Two things are shared by both modes in a workspace: webhook endpoints (see [Webhooks](/docs/api-reference/webhooks)) and the monthly request counters in [Usage](/docs/api-reference/usage).

## Rate limit headers

Every authenticated response includes:

| Header | Meaning |
| --- | --- |
| `X-RateLimit-Limit` | Requests allowed per minute for this key, from your plan (Spark 60, Beam 120, Spectrum 600, Aurora 1,200). |
| `X-RateLimit-Remaining` | Requests left in the current one-minute window. |
| `Retry-After` | Only on `429 rate_limited`: seconds until the window resets. |
| `Request-Id` | On every response: the `req_…` ID of the request. |

The limit is per key and counted in fixed one-minute windows. Requests over the limit are not counted in your usage.

## Authentication errors

```json
{
  "error": {
    "type": "authentication_error",
    "code": "invalid_api_key",
    "message": "This API key does not exist or was revoked.",
    "retryable": false,
    "request_id": "req_01KJ8T3C5D7E9F1G3H5J7K9M1N",
    "docs_url": "https://prismareviews.com/docs/errors#invalid_api_key"
  }
}
```

| Status | `code` | When |
| --- | --- | --- |
| 401 | `missing_api_key` | No `Authorization` header, a scheme other than `Bearer`, or a value that isn't shaped like a Prisma key. |
| 401 | `invalid_api_key` | The key is well formed but doesn't exist or was revoked. |
| 429 | `rate_limited` | More requests in one minute than your plan allows. |

All codes are on [Errors](/docs/errors). How Prisma protects keys and platform tokens is on [Security](/security).