API Keys

API keys allow users and their integrations to authenticate with the Prime API programmatically — without a username/password or OAuth flow. Keys are scoped to specific permissions and belong to the account they were created in.

How it works

API keys are generated server-side and returned once at creation. The raw key is never stored — only a hashed version is kept in the database. If a key is lost, it must be regenerated.

Keys are encrypted at rest using:

API_KEY_ENCRYPTION_KEY=your_encryption_key

Expiration

Keys can optionally be given an expiration date, set only at creation time — expiration cannot be changed on an existing key. To rotate a key onto a new expiration, create a new key and revoke the old one. Keys created without an expiration never expire.

Once a key's expiration date has passed, it fails authentication (401, distinct from a revoked key). No expiration-warning notifications are sent yet — check the expires_at field on a key to see when it will expire.

API endpoints

Method	Endpoint	Description
POST	/key	Create a new API key. Accepts an optional expires_at (ISO 8601 timestamp); omit or pass null for a key that never expires.
GET	/key	List all keys for the account
GET	/key/:id	Get details for a specific key
PATCH	/key/:id	Update key name or scopes. expires_at is immutable and is ignored if sent.
DELETE	/key/:id	Revoke a key
GET	/scopes	List all available permission scopes

Scopes

When creating a key, you assign one or more scopes that define what the key can do. Available scopes are exposed via GET /scopes.

Examples:

• key.read — read key information
• key.create — create new keys
• key.update — update existing keys
• key.delete — revoke keys

Using an API key

Pass the key in the Authorization header:

Authorization: Bearer your_api_key

Plan access

API key endpoints are available to accounts on all plan tiers: free-tier, standard, premium, and professional.