# Authentication

How to use, protect, rotate, and revoke feed tokens and API keys.

Use a **feed token** to download one saved object's feed. Use an **API key** for scoped access across your account.

|  | Feed token | API key |
| --- | --- | --- |
| Where it goes | In the URL path | In an `Authorization` header |
| What it covers | One saved object's feed | Whatever its scopes reach: the company register, your markets, your watches, your projects |
| What it permits | Reading only | Whatever its scopes say |
| Where it comes from | The object's Connect page | [prospex.ch/app/api-keys/](https://prospex.ch/app/api-keys/) |

## Feed tokens

All three feed families put the token in the path:

```plaintext
https://prospex.ch/app/markets/feed/<token>.json
https://prospex.ch/app/markets/feed/<token>.csv
https://prospex.ch/app/watch/feed/<token>.json
https://prospex.ch/app/watch/feed/<token>.csv
https://prospex.ch/app/prospect/feed/<token>.json
```

The URL is the whole credential. Keep it out of shared documents, ticket comments, and anything that logs full URLs.

Each object's Connect page carries a button that mints a new token. The previous one stops answering immediately with **404**, the same status as a deleted market, so no response confirms whether a token existed.

## API keys

A key looks like this and is shown once:

```plaintext
pxk_a1b2c3d4_<43 more characters>
```

The first twelve characters are a public prefix, safe to quote in a log or a support thread. The remaining 43 are the secret.

## Scopes

Chosen when you issue the key and fixed for its lifetime.

| Scope | Permits |
| --- | --- |
| prospect:read | Read projects and prospects |
| prospect:write | Add companies and record decisions |
| prospect:run | Start cycles and request research |
| prospect:stages | Read, claim and complete external stage jobs |
| prospect:approve | Approve a named outreach revision |
| prospect:outcomes | Record downstream outcomes (published, and no route accepts it yet) |
| webhooks:manage | Manage webhook endpoints (published, and no route accepts it yet) |
| companies:read | Search the Swiss company directory |
| markets:read | Read your markets and their companies |
| watches:read | Read your watches and their signals |

The [Prospect API](https://prospex.ch/docs/api/) page lists every route that answers.

Approving is a separate scope because it releases customer-facing copy.

The three `:read` scopes come with a Prospex subscription. The `prospect:*` scopes are part of a closed pilot: the keys page offers what your account can use, and the reference lists all of them, so a key issued today needs no reissuing when the pilot opens.

## Webhook signatures

Each webhook endpoint has a signing secret, with the previous secret still valid long enough for you to deploy a receiver change. The verification code is on [Webhooks](https://prospex.ch/docs/webhooks/).