Authentication - Prometheus

API keys

Create keys on the Developers page in the terminal (prometheus.services/developers). Any account can — the Free plan needs no card. Send the key on every request, either way:

curl "https://www.prometheus.services/api/v1/companies/NVDA" \
  -H "X-API-KEY: pk_live_YOUR_KEY"

# equivalent
curl "https://www.prometheus.services/api/v1/companies/NVDA" \
  -H "Authorization: Bearer pk_live_YOUR_KEY"

A key is shown once, at creation. Prometheus stores only its SHA-256 hash — a lost key cannot be recovered, only rotated.

Key lifecycle

Action	Where	Effect
Create	Developers → API Keys	Up to 10 active keys per account
Rotate	Developers → API Keys	Old key revoked and replaced atomically; new secret shown once
Revoke	Developers → API Keys	Permanent; takes effect everywhere within ~60 seconds

Scope of a key

Keys are data credentials. They work on every documented data endpoint and are deliberately rejected (401) on account surfaces: key management, billing, watchlists, workspace. A leaked data key can never mint more keys or touch the account that owns it.

Tiers

public endpoints (coverage stats, logos, photos, health) need no credentials.
Everything else needs a key (or a signed-in terminal session’s Cognito ID token — that is what the terminal itself uses, but it expires hourly; programmatic access should use keys).
A 402 with code upgrade_required marks a Pro-only surface.

⌘I