Authentication & API keys

Every request to the Prokure API carries an API key in an Authorization header:

Authorization: Bearer pk_live_YOUR_KEY_HERE

There is no other credential to manage — no client ID, no token exchange, no refresh step. The key you copy out of the portal is the key you send.

Key format

A key secret is the prefix pk_live_ followed by 32 bytes of cryptographically random data, base64url-encoded. The prefix is part of the credential: send the whole string, exactly as the portal displayed it.

Lifecycle

Created in the portal. Keys are minted at Settings → API keys in app.prokure.ca. Creating a key is a browser-session action — an API key can never mint another API key, so a leaked key cannot create successors for itself.

Shown once. The secret appears in the creation response and nowhere else. Prokure stores only a SHA-256 hash of it, so no later request can reproduce it. The portal’s key list shows a name, the last few characters, the scopes, and when the key was last used — never the secret.

Revocable at any time. Delete a key from the portal, or call DELETE /api/v1/api-keys/{id} from a signed-in browser session. Revocation takes effect immediately: every request is checked against the stored hash on each call, with no caching layer to wait out.

Optionally expiring. A key can be given an expiry at creation time. An expired key is rejected the same way a revoked one is.

Lost a secret?

There is no recovery path. Revoke the key and create a replacement.

Keys are tenant-scoped

A key belongs to the company that created it, and to the member who created it. Everything it can reach is scoped to that company’s data — there is no cross-company access and no parameter that widens it.

Scopes

Select scopes when you create the key. A key can only do what its scopes allow, and an empty scope list grants nothing.

Scope	Label	Grants
opportunities:read	Read opportunities	List and read matched solicitations and their scoring rationale.
opportunities:write	Give feedback	Send feedback on opportunities, which Prok learns from.
profile:read	Read company profile	Read the company profile, product catalog, and certifications.
profile:write	Edit company profile	Change the company profile, product catalog, and certifications.
settings:read	Read settings	Read digest schedule, recipients, and learned decision rules.
settings:write	Change settings	Change digest schedule, recipients, and learned decision rules.

The live vocabulary is served from GET /api/v1/scopes, which is a public endpoint — you can read it before you have a key.

A request whose key lacks the required scope is rejected with 403 insufficient_scope, and the message names the scope that was missing.

Pick the narrowest set

Give each key only the scopes its job needs. A reporting integration that reads opportunities into a dashboard wants opportunities:read and nothing else; adding profile:write to it only widens what a leak would cost you. Separate keys per integration are cheap, and revoking one does not disturb the others.