Skip to main content
Prompt Bank authenticates every request using an API key passed as a Bearer token. You must include your API key in the Authorization header on every request. Requests without a valid key are rejected with 401 Unauthorized.

​
Authorization header format

Set the Authorization header to Bearer followed by your API key:
API keys follow the format pb_live_<publicid>_<secret>. Keep the full string — including the pb_live_ prefix — as the token value.

​
API key scopes

Each API key carries one or more scopes that control which operations it can perform. Write endpoints — such as POST /prompts, POST /generations, or DELETE /vaults/{vaultId} — require the prompts:write scope. Sending a request to a write endpoint with a key that lacks this scope returns 401 Unauthorized.

​
Creating API keys

You create API keys through the Prompt Bank dashboard or programmatically via the API. Key creation is a browser-session-only operation: POST /api/v1/api-keys is only available when authenticated with a valid browser session and cannot be called with an existing API key.
The raw API key value is returned only once, immediately after creation. Prompt Bank does not store the secret portion and cannot show it to you again. Copy and store your key in a secure location such as a secrets manager or encrypted environment variable before closing the creation response.
See the API Keys reference for full details on creating, listing, and revoking keys.

​
401 Unauthorized

If you receive a 401 Unauthorized response, the most common causes are:
  • Missing header — The Authorization header was not included in the request.
  • Malformed header — The value does not start with Bearer (note the space), or the key is truncated.
  • Invalid or revoked key — The key does not exist or has been revoked in the dashboard.
  • Insufficient scope — The key exists but lacks the prompts:write scope required by the endpoint.
To resolve a 401, verify that the header is present and correctly formatted, confirm the key is active in your dashboard, and ensure the key has the required scope for the operation you are attempting.