Authentication

Your API key is the last path segment of your endpoint. There is no header to set and no bearer token to manage - every standard EVM client can point at a URL, which is why Prism authenticates that way.

https://mainnet.prismrpc.co/v1/pk_live_8f2c91d4e7a3
                                 └──────┬──────┘
                                    your key

Key scoping

Every key carries three controls. Set them when you create the key and change them at any time without rotating.

Public and private keys

Split your keys by trust boundary rather than by environment alone.

A private key lives on your server, has no method restrictions, and carries your full rate limit. It is the only key that should ever submit transactions.

A public key is safe to embed in frontend code. Restrict it to reads and lock it to your domains:

{
  "label": "web-frontend",
  "originLock": ["https://app.example.com", "https://example.com"],
  "allowedMethods": [
    "eth_blockNumber",
    "eth_call",
    "eth_chainId",
    "eth_estimateGas",
    "eth_gasPrice",
    "eth_getBalance",
    "eth_getBlockByNumber",
    "eth_getLogs",
    "eth_getTransactionByHash",
    "eth_getTransactionReceipt"
  ],
  "rateLimit": { "perSecond": 25, "perMonth": 5000000 }
}

An origin lock is a meaningful control in a browser but not a cryptographic one - the Origin header can be forged by a non-browser client. Pair it with the method allowlist so a leaked public key can only read.

Rotation

Keys can overlap. Create the replacement, deploy it, confirm traffic has moved on the dashboard, then revoke the old one. Revocation takes effect at the edge within seconds.

Rotate immediately if a key appears in a public repository, a client bundle you did not intend, a CI log, or a support ticket.

Server-side proxying

If you cannot ship any key to the browser, proxy through your own backend and keep the Prism URL server-side:

// app/api/rpc/route.ts
export async function POST(request: Request) {
  const body = await request.json();

  // Only allow the methods your frontend actually needs.
  const allowed = ['eth_call', 'eth_blockNumber', 'eth_getBalance'];
  if (!allowed.includes(body.method)) {
    return Response.json(
      {
        jsonrpc: '2.0',
        id: body.id ?? null,
        error: { code: -32601, message: 'Method not allowed' },
      },
      { status: 200 }
    );
  }

  const upstream = await fetch(process.env.PRISM_RPC_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  });

  return Response.json(await upstream.json());
}

This costs you a round trip. An origin-locked public key is usually the better trade unless you need per-user authorisation on top.

Errors

Full list in errors & troubleshooting.