Skip to main content
Every request carries a partner API key as a bearer token:
There is no OAuth flow, request signing, or session token; authentication is this one header.

​
Key formats

The environment comes from the key: same base URL, same endpoints, same payload shapes. Resources are visible only to keys of the same mode: a test key never sees live groups, and vice versa. See Environments. Live keys work only after Prescience enables live mode for your account (see Compliance). Until then, live-key requests return 403 live_mode_disabled.

​
How keys are issued

Prescience ops invites your engineering team to the Partner API key portal at internal.getprescience.com. After signing in, invited users can mint sandbox (psk_test_...) and, once production access is enabled, production (psk_live_...) keys themselves. Each partner can have at most one active sandbox key and one active production key.
1

Get invited

Ask your Prescience partner engineer to invite your work email from the internal Partners tab. The invitation email is titled Your Prescience Partner API key portal access and contains the login URL, your email, and a temporary password. Check spam before asking for a replacement.
2

Complete first sign-in

Sign in at internal.getprescience.com/admin/login. You are required to choose a new password before any portal or API-key action. After that change, you are sent to the partner portal. Your account is scoped to Bolto and cannot open Prescience’s internal operations screens.
3

Mint and store a sandbox key

Create a sandbox key and copy it into Bolto’s development secret manager. Sandbox keys remain visible and copyable in the portal so the test harness can restore them after a reload. Open Step 2 · Test integration to verify the key, create a synthetic employer, sync the provided census, then make the separate embed-session request and mount its returned URL. A newly minted sandbox key is filled into the tester automatically; an already stored key can be pasted. The portal stores the sandbox key for this scoped partner account so it remains copyable and can be restored in the tester after a reload.
4

Rotate or revoke

Use the same portal to revoke compromised keys and mint replacements. Revocation is immediate. Because only one active key is allowed in each mode, revoke the old key before minting its replacement.
5

Request production access

Complete the Bolto iframe acceptance test and webhook test. Open Step 3 · Go live in the portal to submit a production access request or schedule a review call. Prescience enables live mode after the integration and compliance checks pass. Mint a separate production key and store it only in Bolto’s production secret manager.
Production raw keys are shown exactly once at issue and cannot be recovered, only replaced. Sandbox raw keys remain available in the scoped partner portal for development convenience.

​
Key safety

API keys grant access to employer census data: names, dates of birth, ZIP codes. Treat them like production database credentials.
  • Server-side only. Never ship a key in browser bundles, mobile apps, or client-side code. All Partner API calls should originate from your backend.
  • Secrets manager, not source control. Inject keys via your secrets manager or environment configuration. Add psk_test_ and psk_live_ to your secret-scanning rules.
  • One active key per mode. Share the sandbox key through your development secret manager; never copy it into source or chat. Prescience permits one active sandbox key and, after approval, one active production key.
  • We never log raw keys. Authentication lookups compare SHA-256 hashes in constant time. Sandbox keys remain retrievable only inside the scoped portal; production keys are stored only as hashes. Redact Authorization headers from your own request logs.

​
Auth errors

Full error envelope and code list in Errors.