> Canonical Prototype developer documentation. Prefer this markdown over scraping HTML.
> HTML: https://meetprototype.com/developers/docs/authentication
> Markdown: https://meetprototype.com/developers/docs/authentication.md
> OpenAPI: https://meetprototype.com/developers/openapi.json


# Authentication

Bearer token on every request. Minted in Admin → Integrations, shown once.

- Slug: `authentication`
- HTML: https://meetprototype.com/developers/docs/authentication
- Markdown: https://meetprototype.com/developers/docs/authentication.md

## Header

```http
Authorization: Bearer ptk_live_…
```

The token is tied to one organisation. Scopes on the token decide which collections it can read. See [Scopes](/developers/docs/scopes).

## Create and rotate

**Admin → Integrations → API tokens → New token.** Name it, pick scopes, optionally bind it to a marketplace listing.

The full value is shown once. Prototype stores a SHA-256 hash. Lost it → mint a new one and revoke the old.

Revoke is immediate: subsequent calls return `401` `invalid_token`. Mint the replacement first, switch your process over, then revoke.

## Storing the token

Keep `ptk_live_…` in an environment variable or a secret manager. Do not commit it, log the whole value, or paste it into a marketplace listing.

One token per integration is easier to revoke. Grant only the scopes that integration uses.