API Authentication: Bearer Tokens & Keys | Prompt Bank

Every request to the Prompt Bank API must be authenticated using a Bearer token. You obtain a token by creating an API key through your account dashboard at promptbank.club. Once you have a key, include it in the Authorization header of every HTTP request — no cookies, no OAuth redirects, just a single header.

Create an API key

The easiest way to create an API key is from the API Keys section of your account settings at promptbank.club. Click Create API key, enter a descriptive name (up to 80 characters), and copy the key immediately — it is shown in full only once. See the API Keys reference for the full request and response schema.

The complete API key — including the secret portion — is returned only once, at the moment of creation. Copy and store it securely before closing the response. If you lose the key, you must delete it and create a new one.

Use your API key

Pass your API key as a Bearer token in the Authorization header of every request. The header value follows this pattern:

Authorization: Bearer pb_live_publicid_secret

The key format is pb_live_ followed by a public identifier, an underscore, and the secret portion. The full string is what you pass after Bearer.

curl https://www.promptbank.club/api/v1/prompts \
  -H "Authorization: Bearer pb_live_publicid_secret"

const response = await fetch('https://www.promptbank.club/api/v1/prompts', {
  headers: {
    'Authorization': 'Bearer pb_live_publicid_secret',
  },
});

const data = await response.json();

import urllib.request
import json

req = urllib.request.Request(
    'https://www.promptbank.club/api/v1/prompts',
    headers={'Authorization': 'Bearer pb_live_publicid_secret'},
)

with urllib.request.urlopen(req) as res:
    data = json.loads(res.read())

Scopes

API keys carry permission scopes that control which operations they can perform.

Scope	Description
`prompts:read`	Read prompts and vault contents. Granted to all keys by default.
`prompts:write`	Create, update, delete prompts, queue generations, and upload images. Required for any write operation.

You can verify a key’s assigned scopes by calling GET /api/v1/api-keys/{keyId}.

Security best practices

Treat API keys like passwords. Never hard-code a key directly in your source code or commit it to a version control repository. Use environment variables or a secrets manager (such as AWS Secrets Manager, HashiCorp Vault, or your CI platform’s secret store) to inject keys at runtime. Rotate keys regularly, and immediately revoke any key you suspect has been compromised.

A few additional practices to keep your keys secure:

Use one key per environment. Create separate keys for development, staging, and production so you can revoke a single environment’s access without affecting others.
Apply the principle of least privilege. Only assign the scopes a key actually needs. A key used only for reading prompts should not have prompts:write.
Audit key usage. Review the list of active API keys periodically and delete any that are no longer in use.

Error reference

The following HTTP status codes relate directly to authentication and access failures.

Status code	Meaning	Common cause
`401 Unauthorized`	Missing or invalid Bearer token	The `Authorization` header is absent, the token is malformed, or the key has been revoked.
`404 Not Found`	Resource does not exist	The resource ID in the path does not exist, or it belongs to another account your key cannot access.

All error responses follow the standard envelope format: { "data": null, "error": "message", "details": {} }.

Get Started

Core Concepts

Guides

API Authentication: Bearer Tokens & Keys | Prompt Bank

Create an API key

Use your API key

Scopes

Security best practices

Error reference

​Create an API key

​Use your API key

​Scopes

​Security best practices

​Error reference

Create an API key

Use your API key

Scopes

Security best practices

Error reference