> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prisminference.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Prism inference requests and protect API keys.

Every inference request requires a Prism API key. Use the
`PRISM_API_KEY` environment variable in local examples and a secret manager in
deployed applications.

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
export PRISM_API_KEY="YOUR_PRISM_API_KEY"
```

## Bearer authentication

Bearer authentication works with every endpoint:

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer YOUR_PRISM_API_KEY
```

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl "https://api.prisminference.com/v1/chat/completions" \
  -H "Authorization: Bearer $PRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "prism-glm53",
    "messages": [{"role": "user", "content": "Return pong."}]
  }'
```

## Anthropic authentication

Anthropic clients send the key in `x-api-key`. The Messages endpoints accept
this header:

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
x-api-key: YOUR_PRISM_API_KEY
anthropic-version: 2023-06-01
```

Bearer authentication is also accepted on the Messages endpoints.

## Base URLs

| Client                            | Base URL                                                     |
| --------------------------------- | ------------------------------------------------------------ |
| OpenAI SDK and compatible clients | `https://api.prisminference.com/v1`                          |
| Anthropic SDK and Claude Code     | `https://api.prisminference.com`                             |
| Direct HTTP                       | `https://api.prisminference.com` plus the full endpoint path |

The Anthropic SDK appends `/v1/messages`, so its base URL must not end in
`/v1`.

## Protect keys

* Keep keys in server-side environment variables or a managed secret store.
* Do not put keys in browser code, mobile binaries, logs, or prompts.
* Use a separate key for each environment or service.
* Replace a key immediately if it is exposed.
* Return your own short-lived session credential to untrusted clients instead
  of proxying a Prism key to them.

Requests with a missing, invalid, or revoked key return `401`.