Skip to main content

API Keys

PrompTick has two kinds of API keys. Both are issued from the UI, both are hashed at rest, and both are shown as plaintext exactly once.

Key typePrefixUsed forManaged at
Agent API keypk_live_Calling a specific agent at POST /api/v1/agents/{agentId}/execute and polling its executions.The agent's API Keys panel.
MCP API keymk_live_Authenticating an MCP client (e.g. Claude Code, Cursor, Windsurf) to PrompTick's MCP endpoint.User-level MCP settings.

The two types are tracked separately and cannot be swapped — a pk_live_ key will not authenticate the MCP endpoint, and vice versa.

How keys are generated and stored​

  • A new key is a high-entropy random string, prefixed with pk_live_ or mk_live_.
  • Before the key is stored, it is hashed. Only the hash is written to our database; the plaintext is not.
  • A short prefix (e.g. pk_live_abc123…) is stored alongside the hash purely so the UI can show you which key is which.
  • The plaintext key is returned to you exactly once, in the response to the creation request, and shown in the UI only at that moment. It is not retrievable afterwards.

If you lose a key, there is no recovery path — revoke it and create a new one.

Who can create and manage agent API keys​

Agent keys are creator-only: only the user who created the agent can create, list, or revoke keys for that agent. Organization admins who are not the agent's creator cannot manage its keys.

If the creator leaves the organization and you need to reset the keys, you currently need to redeploy the agent under a new owner and re-issue keys.

Rotation​

There is no built-in "rotate" button. Rotation is done by:

  1. Create a new key with a descriptive name (e.g. helpdesk-webhook-2026-04).
  2. Deploy the new key to your integration.
  3. Confirm traffic is succeeding on the new key in Execution History.
  4. Revoke the old key from the same API Keys panel.

Because each key has its own rate limit bucket, running old and new in parallel for a short window is safe.

Revocation​

Revoking a key removes it immediately — any request made with it after that point returns 401 Invalid or revoked API key. Revoked keys remain listed (showing name and prefix) for audit purposes.

Rate limits​

Each agent API key has its own rate limit settings — requests per minute, per hour, per day — configured when the key is created (with sensible defaults). Limits are enforced per key, not per user or per agent, so a single agent can have several keys with different limits (for example, a low-limit development key and a production key). Exceeding a limit returns 429 Rate limit exceeded.

Using a key​

Pass the key in the Authorization header:

Authorization: Bearer pk_live_...

Store it in your secret manager (AWS Secrets Manager, GCP Secret Manager, Doppler, 1Password, etc.) — never in source control, client bundles, or chat messages.

See Agents → API Keys for the step-by-step UI flow and API → Authentication for wire-level details.