Authentication

External callers authenticate with a project API key sent in the x-api-key header. Keys are scoped to a single project.

POST /v1/YOUR_PROJECT_ID/prompts/summarize-ticket/execute HTTP/1.1
Host: router.promptlab.vernalabs.net
x-api-key: plp_xxx_xxx
Content-Type: application/json

The project id is part of the URL path (/v1/:projectId/...), so most routes need only the x-api-key header. The SDK also sets x-project-id and an optional x-correlation-id for you.

Key format

Keys look like:

plp_<keyId>_<secret>

The full token is shown once at creation time — store it in a secret manager. VernaOne keeps only a hash; listings show a masked value like plp_<keyId>_â€ĸâ€ĸâ€ĸâ€ĸ1234.

Scopes

ScopeGrants
project:readGET / HEAD — list and read prompts, poll jobs
project:writeExecute prompts, create embeddings, and other writes

Give a key only the scopes it needs.

Issue and revoke keys

Manage keys in the app under Project settings → API keys:

  • Create — generates a new plp_â€Ļ token (copy it immediately).
  • List — shows masked keys and their scopes.
  • Revoke — disables a key immediately.

Keep keys server-side

A plp_â€Ļ key can execute prompts and spend against your connected providers. Treat it like any other secret:

  • Never ship it in browser or mobile client code.
  • Use it from your backend, an edge function, or a trusted server.
  • Rotate keys periodically and revoke any that may have leaked.

MCP note: the MCP server also accepts Authorization: Bearer plp_â€Ļ as an alias for x-api-key. See MCP server.