Authentication

All API requests require authentication using your project's API key.

API Key Authentication

Include your API key in the request headers using the x-api-key header, or send it as Authorization: Bearer:

x-api-key: <YOUR_API_KEY>

Getting Your API Key

Each project has an automatically generated API key. To access it:

  1. Log in to your SuperPrompts account
  2. Open your project
  3. Go to Settings → API
  4. Copy the key from the API Key card

New and regenerated keys are sp_ followed by 64 hexadecimal characters. Keys created before September 2026 are longer and came from a weaker random generator; they still work, but we recommend regenerating them.

Example Requests

cURL

curl https://superprompts.app/api/v2/prompts/<PROMPT_ID> \
  -H "x-api-key: sp_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

JavaScript (fetch)

const response = await fetch(
  'https://superprompts.app/api/v2/prompts/<PROMPT_ID>',
  {
    headers: {
      'x-api-key': 'sp_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef'
    }
  }
);

const { data } = await response.json();
console.log(data.prompt);

Python (requests)

import requests

response = requests.get(
    'https://superprompts.app/api/v2/prompts/<PROMPT_ID>',
    headers={'x-api-key': 'sp_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef'}
)

data = response.json()['data']
print(data['prompt'])

Node.js (axios)

import axios from 'axios';

const response = await axios.get(
  'https://superprompts.app/api/v2/prompts/<PROMPT_ID>',
  {
    headers: {
      'x-api-key': 'sp_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef'
    }
  }
);

console.log(response.data.data.prompt);

Security Best Practices

Keep Your API Key Secret

Never commit your API key to version control or expose it in client-side code. Always use environment variables.

Environment Variables

Store your API key in environment variables:

# .env file
SUPERPROMPTS_API_KEY=sp_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

Then access it in your code:

const apiKey = process.env.SUPERPROMPTS_API_KEY;

Server-Side Only

Always make API requests from your server, never from client-side JavaScript. This prevents exposing your API key to users.

Regenerate a Leaked Key

If you suspect your API key has been exposed, regenerate it right away. The old key stops working the moment you do. See Regenerating a Key.

Regenerating a Key

Open the project, go to Settings → API and click Regenerate key, then confirm. Only the organization owner can regenerate a key; other members can see and copy it but not replace it.

What happens

  • A new key is created and shown right away. It stays available under Settings → API.
  • The old key stops working immediately for the REST API, the Node SDK and the MCP server. Requests that still send it get 401 Invalid API key.
  • Prompts, versions and project ids do not change. Apps connected with OAuth (Settings → Connected apps) keep working, because they do not use the key.
  • Settings → Activity records who regenerated the key and when, with a short fingerprint of the old and new keys. The keys themselves are never stored in the log.

What to update

Replace the old key everywhere it is used:

  • Environment variables and secret stores of every app or server that calls the API (for example SUPERPROMPTS_API_KEY), then redeploy or restart it
  • CI jobs and deployment pipelines
  • SDK clients created with new SuperPrompts({ apiKey })
  • MCP clients that send the key in a header: Claude Code (claude mcp remove superprompts, then add it again with the new key in --header), Cursor (.cursor/mcp.json), Claude Desktop (claude_desktop_config.json) and VS Code (.vscode/mcp.json)

Deleting a project also revokes its key immediately.

Error Responses

Errors use the same envelope as every API response: { "success": false, "error": "…" }.

Missing API Key

If you send neither an x-api-key header nor Authorization: Bearer:

HTTP/1.1 401 Unauthorized

{
  "success": false,
  "error": "API key required. Send it as an x-api-key header or as Authorization: Bearer."
}

Invalid API Key

If the key is wrong, was regenerated, or belongs to a deleted project:

HTTP/1.1 401 Unauthorized

{
  "success": false,
  "error": "Invalid API key"
}

Too Many Failed Attempts

Failed authentication is limited per client address. After too many invalid keys from one address in a minute, further invalid attempts get a 429 instead of a 401 until Retry-After seconds have passed:

HTTP/1.1 429 Too Many Requests
Retry-After: 37

{
  "success": false,
  "error": "Too many failed authentication attempts. Try again in a minute."
}

Rate Limit Exceeded

If a valid key goes over your organization's per-minute limit (60 requests per minute on Free):

HTTP/1.1 429 Too Many Requests
Retry-After: 42
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 42

{
  "success": false,
  "error": "Rate limit exceeded. Try again in 42 seconds."
}