curl --request POST \
--url https://pria.praxislxp.com/api/auth/api-key-signin \
--header 'x-api-key: <api-key>'import requests
url = "https://pria.praxislxp.com/api/auth/api-key-signin"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://pria.praxislxp.com/api/auth/api-key-signin', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://pria.praxislxp.com/api/auth/api-key-signin",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://pria.praxislxp.com/api/auth/api-key-signin"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://pria.praxislxp.com/api/auth/api-key-signin")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://pria.praxislxp.com/api/auth/api-key-signin")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"profile": {
"_id": "6430736fd62d650040420674",
"email": "integration-bot@praxis-ai.com",
"fname": "Integration",
"lname": "Bot",
"accountType": "admin",
"plan": "pro",
"status": "active",
"credits": 1000,
"creditsUsed": 12,
"institution": {
"_id": "68793ef2a8a4a5eaff36e7ca",
"name": "domain.edu",
"status": "active",
"credits": 500,
"ainame": "Hugo"
}
}
}{
"success": false,
"message": "x-api-key header is required"
}{
"success": false,
"message": "Invalid API key"
}{
"success": false,
"message": "API key not authorized from this source",
"code": "source_not_allowed"
}{
"success": false,
"message": "Sign-in failed: <error details>"
}Exchange a Pria API key for a JWT
Validates the x-api-key header against the hashed key stored on the user record
and returns a regular Pria JWT (token) plus a minimal profile envelope. The
JWT is identical in shape and lifetime to the one issued by POST /api/auth/signin
— every other authenticated endpoint accepts it via Authorization: Bearer <jwt>
or x-access-token: <jwt>.
Important: the API key is NOT a JWT. Sending the raw pria_… key as a
Authorization: Bearer value will fail with Invalid access token jwt malformed
on the bearer-protected endpoints. You must do the exchange here first.
Authentication transport: the API key MUST be sent in the x-api-key header,
not Authorization. The endpoint has no JWT gate — only the key check.
Access gating:
- Key format is enforced:
pria_followed by 40 hex chars (/^pria_[0-9a-f]{40}$/). A malformed key returns 401, not 400. - Lookup uses the 9-char prefix for indexing, then verifies the full SHA-256 hash.
- Only users with
accountTypeofadminorsuper(andstatus !== 'deleted') can mint a JWT. Demoting a user immediately disables their key.
Rate limiting: 100 requests per minute per IP (the shared auth limiter).
curl --request POST \
--url https://pria.praxislxp.com/api/auth/api-key-signin \
--header 'x-api-key: <api-key>'import requests
url = "https://pria.praxislxp.com/api/auth/api-key-signin"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://pria.praxislxp.com/api/auth/api-key-signin', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://pria.praxislxp.com/api/auth/api-key-signin",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://pria.praxislxp.com/api/auth/api-key-signin"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://pria.praxislxp.com/api/auth/api-key-signin")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://pria.praxislxp.com/api/auth/api-key-signin")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"profile": {
"_id": "6430736fd62d650040420674",
"email": "integration-bot@praxis-ai.com",
"fname": "Integration",
"lname": "Bot",
"accountType": "admin",
"plan": "pro",
"status": "active",
"credits": 1000,
"creditsUsed": 12,
"institution": {
"_id": "68793ef2a8a4a5eaff36e7ca",
"name": "domain.edu",
"status": "active",
"credits": 500,
"ainame": "Hugo"
}
}
}{
"success": false,
"message": "x-api-key header is required"
}{
"success": false,
"message": "Invalid API key"
}{
"success": false,
"message": "API key not authorized from this source",
"code": "source_not_allowed"
}{
"success": false,
"message": "Sign-in failed: <error details>"
}Authorizations
Long-lived Pria API key (format pria_<40 hex chars>) used to obtain a JWT via
POST /api/auth/api-key-signin. Only valid on the api-key-signin endpoint —
every other admin/user endpoint expects the JWT issued by that exchange (sent as
Authorization: Bearer <jwt> or x-access-token: <jwt>).
Headers
Pria API key (pria_ + 40 hex chars). Provisioned by an admin via the admin UI.
^pria_[0-9a-f]{40}$Response
Key accepted — JWT and minimal profile returned.
JWT signed for the API-key-bound user. Use it in subsequent calls via
Authorization: Bearer <token> or the x-access-token header. Token TTL
matches the normal signin flow (6 hours by default, configurable via
JWT_VALIDITY_SEC).
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Minimal profile envelope tailored for SDK / integration consumers. Smaller than the regular signin profile — see properties below.
Show child attributes
Show child attributes
Was this page helpful?