Skip to main content
Every request carries a partner API key as a bearer token:
There is no OAuth flow, request signing, or session token; authentication is this one header.

​
Key formats

The environment comes from the key: same base URL, same endpoints, same payload shapes. Resources are visible only to keys of the same mode: a test key never sees live groups, and vice versa. See Environments. Live keys work only after Prescience enables live mode for your account (see Compliance). Until then, live-key requests return 403 live_mode_disabled.

​
How keys are issued

Prescience ops invites your engineering team to the Partner API key portal at internal.getprescience.com. After signing in, invited users can mint sandbox (psk_test_...) and, once production access is enabled, production (psk_live_...) keys themselves. Each partner can have at most one active sandbox key and one active production key.
1

Get invited

Ask your Prescience partner engineer to invite your work email from the internal Partners tab. The invitation email is titled Your Prescience Partner API key portal access and contains the login URL, your email, and a temporary password. Check spam before asking for a replacement.
2

Complete first sign-in

Sign in at internal.getprescience.com/admin/login. You are required to choose a new password before any portal or API-key action. After that change, you are sent to the partner portal. Your account is scoped to Bolto and cannot open Prescience’s internal operations screens.
3

Mint and store a sandbox key

Create a sandbox key and copy it into Bolto’s development secret manager. Sandbox keys remain visible and copyable in the portal so the test harness can restore them after a reload. Open Step 2 · Test integration to verify the key, create a synthetic employer, sync the provided census, then make the separate embed-session request and mount its returned URL. A newly minted sandbox key is filled into the tester automatically; an already stored key can be pasted. The portal stores the sandbox key for this scoped partner account so it remains copyable and can be restored in the tester after a reload.
4

Rotate or revoke

Use the same portal to revoke compromised keys and mint replacements. Revocation is immediate. Because only one active key is allowed in each mode, revoke the old key before minting its replacement.
5

Request production access

Complete the Bolto iframe acceptance test (a webhook is optional). Under Step 3 · Go live in the portal, click Request production access, or schedule a review call. The button records your request and lists any go-live prerequisites still missing; it does not turn on live mode. Prescience turns on live mode. Then mint a separate production key and store it only in Bolto’s production secret manager.
Production raw keys are shown once in the partner portal at issue. Store them in your secrets manager. Prescience Internal superadmins can recover retained keys through an audited reveal action; older hash-only keys cannot be recovered. Sandbox raw keys remain available in the scoped partner portal for development.

​
Key safety

API keys grant access to employer census data: names, dates of birth, ZIP codes. Treat them like production database credentials.
  • Server-side only. Never ship a key in browser bundles, mobile apps, or client-side code. All Partner API calls should originate from your backend.
  • Secrets manager, not source control. Inject keys via your secrets manager or environment configuration. Add psk_test_ and psk_live_ to your secret-scanning rules.
  • One active key per mode. Share the sandbox key through your development secret manager; never copy it into source or chat. Prescience permits one active sandbox key and, after approval, one active production key.
  • We never log raw keys. Authentication lookups compare SHA-256 hashes in constant time. New keys are encrypted at rest for audited Internal superadmin recovery; authentication still uses hashes. Sandbox keys also remain retrievable inside the scoped partner portal. Redact Authorization headers from your own request logs.

​
Auth errors

Full error envelope and code list in Errors. Brokers use the same keys and portal. Prescience sets up the account and which endpoints your keys can call; see Broker account setup.