> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prysm1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the PRYSM API: keys, the base URL, and environment variables.

PRYSM authenticates with a **bearer API key** over HTTPS. The same key works for the
REST API, the SDKs, the CLI, and the MCP server.

## API keys

PRYSM keys are prefixed `prysm_sk_` (secret key). Create one at
[prysm1.com](https://prysm1.com).

<Warning>
  Your secret key grants full access to your account and is billable. Never commit it
  to source control, embed it in client-side code, or paste it into a browser. If a key
  leaks, rotate it from your dashboard immediately.
</Warning>

## The base URL

All API requests go to:

```
https://api.prysm1.com/v1
```

This base URL already includes the `/v1` version segment — point your OpenAI client at
it and the SDK appends paths like `/chat/completions` automatically.

## Sending the key

Pass the key in the `Authorization` header as a bearer token:

```bash theme={null}
Authorization: Bearer prysm_sk_your_key
```

<CodeGroup>
  ```python prysm1 theme={null}
  from prysm import Prysm

  # Reads PRYSM_API_KEY and PRYSM_BASE_URL from the environment:
  client = Prysm()

  # ...or pass them explicitly:
  client = Prysm(api_key="prysm_sk_your_key", base_url="https://api.prysm1.com/v1")
  ```

  ```typescript @prysmai/sdk theme={null}
  import { Prysm } from "@prysmai/sdk";

  // Reads PRYSM_API_KEY and PRYSM_BASE_URL from the environment:
  const client = new Prysm();

  // ...or pass them explicitly:
  const client = new Prysm({ apiKey: "prysm_sk_your_key", baseURL: "https://api.prysm1.com/v1" });
  ```

  ```python OpenAI SDK theme={null}
  from openai import OpenAI

  client = OpenAI(
      api_key="prysm_sk_your_key",
      base_url="https://api.prysm1.com/v1",
  )
  ```

  ```bash cURL theme={null}
  curl https://api.prysm1.com/v1/chat/completions \
    -H "Authorization: Bearer prysm_sk_your_key" \
    -H "Content-Type: application/json" \
    -d '{ "model": "auto", "messages": [{ "role": "user", "content": "hello" }] }'
  ```
</CodeGroup>

## Environment variables

The SDKs and CLI resolve configuration from the environment, so you never have to
hard-code credentials.

| Variable         | Used for                                 | Default                     |
| ---------------- | ---------------------------------------- | --------------------------- |
| `PRYSM_API_KEY`  | Your `prysm_sk_*` secret key.            | —                           |
| `PRYSM_BASE_URL` | API base URL (override for self-hosted). | `https://api.prysm1.com/v1` |

```bash theme={null}
export PRYSM_API_KEY="prysm_sk_your_key"
# Optional — only if you self-host or target a non-default region:
export PRYSM_BASE_URL="https://api.prysm1.com/v1"
```

<Note>
  For drop-in migrations, the Python and Node SDKs also fall back to `OPENAI_API_KEY`
  if `PRYSM_API_KEY` is not set — so pointing existing code at PRYSM can be a one-line
  base-URL change.
</Note>

## Which endpoints require a key

| Endpoint                      | Auth required |
| ----------------------------- | ------------- |
| `POST /v1/chat/completions`   | Yes           |
| `POST /v2/orchestrate`        | Yes           |
| `POST /v2/code`               | Yes           |
| `POST /v1/route`              | Yes           |
| `POST /v1/agent/run`          | Yes           |
| `GET /v1/usage`               | Yes           |
| `GET /v1/savings`             | Yes           |
| `GET /v1/models`              | No            |
| `POST /v1/brain/validate`     | No            |
| `POST /v2/compliance/preview` | No            |
| `GET /v1/proof/{request_id}`  | No            |
| `POST /v1/agent/verify`       | No            |
| `GET /health`                 | No            |

## Verify your key

Confirm a key is valid and the API is reachable from the CLI:

```bash theme={null}
prysm connect
# connected  user: usr_demo  plan: free  requests: 128
```

Or with cURL:

```bash theme={null}
curl https://api.prysm1.com/v1/usage \
  -H "Authorization: Bearer $PRYSM_API_KEY"
```

A `200` response confirms the key is valid. A `401` means the key is missing, malformed,
or revoked — check the `Authorization` header format.

## Rate limits

Each key has a per-minute request limit tied to your plan. Exceeding it returns
`429 rate_limit_exceeded` with a message describing your limit. Back off and retry, or
upgrade your plan for a higher ceiling.

## Authentication errors

<AccordionGroup>
  <Accordion title="401 — invalid_api_key" icon="lock">
    The key is missing, malformed, or revoked. Check the `Authorization` header is
    present and formatted as `Bearer prysm_sk_...`.

    ```json theme={null}
    { "detail": { "error": "invalid_api_key", "message": "Invalid or missing PRYSM API key." } }
    ```
  </Accordion>

  <Accordion title="429 — rate_limit_exceeded" icon="gauge-high">
    You've exceeded your per-minute request limit. Retry after the current minute, or
    upgrade your plan.

    ```json theme={null}
    { "detail": { "error": "rate_limit_exceeded", "message": "Limit: 60 requests/min." } }
    ```
  </Accordion>
</AccordionGroup>

Next: send your first request in the [Quickstart](/quickstart), or browse the full
[API reference](/api-reference/introduction).