Skip to main content
Every request carries a partner API key as a bearer token:
There is no OAuth flow, request signing, or session token; authentication is this one header.

​
Key formats

The environment comes from the key: same base URL, same endpoints, same payload shapes. Resources are visible only to keys of the same mode: a test key never sees live groups, and vice versa. See Environments. Live keys work only after Prescience enables live mode for your account (see Compliance). Until then, live-key requests return 403 live_mode_disabled.

​
How keys are issued

Keys are provisioned by Prescience support. Test keys are available for development; live keys are issued after live mode is enabled. The raw key is shown exactly once at issue. We store only a SHA-256 hash, so a lost key cannot be recovered, only replaced. To rotate or revoke a key, contact your Prescience partner engineer. Revocation is immediate, and rotation issues the new key before the old one is revoked, so you can cut over with zero downtime.

​
Key safety

API keys grant access to employer census data: names, dates of birth, ZIP codes. Treat them like production database credentials.
  • Server-side only. Never ship a key in browser bundles, mobile apps, or client-side code. All Partner API calls should originate from your backend.
  • Secrets manager, not source control. Inject keys via your secrets manager or environment configuration. Add psk_test_ and psk_live_ to your secret-scanning rules.
  • One key per environment. Use separate test keys for development, CI, and staging so any one can be revoked without collateral damage.
  • We never log raw keys and store them only as hashes; lookups compare hashes in constant time. Do the same: redact Authorization headers from your request logs.

​
Auth errors

Full error envelope and code list in Errors.