Create and Manage Prophic API Keys

Prophic API keys authenticate every request to the partner integrations API. Any org member can create keys for their own use; holders of the Manage integrations permission can list and revoke keys across the whole organization.

Create a key

Open Account → API Keys

Navigate to your account settings and select the API Keys tab.

Add a new key

Give it a clear, descriptive name (for example Salesforce production or Zapier staging) and set an expiry that matches your rotation policy.

Copy the key immediately

The full value (pk_...) is shown once. Copy it into your secret manager right away. Once you close the dialog, only a masked form is visible.

Test the key

Send a request with the X-API-Key header to confirm it works. See API reference for endpoint details.

Never put an API key in a browser URL, query string, or client-side code. Requests that pass the key as a query parameter are rejected with 400. Keys grant full access to your organization’s Quick Quotes.

Use the key

Pass the key in the X-API-Key header on every request to /v1/integrations/*:

curl -X POST "https://api.prophic.ai/v1/integrations/quotations" \
  -H "X-API-Key: pk_..." \
  -H "Content-Type: application/json" \
  -d '{"name":"Acme RFP","requirementsText":"Build a CRM with SSO"}'

Every request is automatically scoped to the organization that owns the key. You cannot pass a different organization ID.

Key lifecycle

Action	Who can do it	Effect
Create	Any org member	New key with a plaintext `pk_...` shown once
Deactivate	Key owner or Manage integrations	Requests return `403` until reactivated
Reactivate	Key owner or Manage integrations	Key resumes working
Revoke	Key owner or Manage integrations	Key is soft-deleted; requests return `403` permanently
List all org keys	Manage integrations	See and manage every key in the organization

Keys track last_used_at on every successful authentication, so you can spot unused keys and clean them up.

Rate limits

Limits apply per API key:

Scope	Limit
All `/v1/integrations/*` requests	60 per minute
`POST /v1/integrations/quotations` (start quote)	10 per minute

If you exceed a limit you get HTTP 429 and a Retry-After header with the number of seconds to wait. Back off and retry after that interval.

For high-volume integrations, create separate keys per workflow (for example one for CRM automation, one for a customer portal). This isolates rate-limit budgets and makes revocation surgical if a credential ever leaks.

Best practices

Rotate regularly. Set expiries that match your security policy and create replacement keys before the old ones lapse.
Use environment-specific keys. Separate production and staging keys so you can revoke one without breaking the other.
Revoke on offboarding. When a team member leaves or a partner integration ends, revoke their keys immediately.
Monitor last_used_at. Delete keys that have not been used in a long time.

Webhooks

Get notified when pipeline steps finish.

Roles and Permissions

Learn what Manage integrations grants.

Get Started

Core Concepts

Setup

Working with Briefs

Integrations

Resources

Create and Manage Prophic API Keys

Create a key

Use the key

Key lifecycle

Rate limits

Best practices

Webhooks

Roles and Permissions

​Create a key

​Use the key

​Key lifecycle

​Rate limits

​Best practices

​Related

Webhooks

Roles and Permissions

Create a key

Use the key

Key lifecycle

Rate limits

Best practices

Related