Skip to main content


For secure access to the Prisma Cloud REST API, you need a Prisma Cloud API access key. An access key includes an Access Key ID and a Secret Key. After you use Prisma Cloud to generate an access key, you can use the key to obtain a JSON Web Token (JWT), which is required to authenticate Prisma Cloud REST API requests. The following steps summarize the API requests necessary to authenticate all other Prisma Cloud API requests.

  1. Use the POST /login request to obtain a JWT.

  2. Authenticate further REST API requests by submitting the JWT in an HTTP header parameter. The following shows the HTTP header parameter key.

    HTTP Request Header ParameterValue
    x-redlock-authYour JWT from POST /login response
  3. Refresh the JWT when necessary. The JWT is valid for 10 minutes, and you must refresh the token for continued access to the Prisma Cloud API. An expired JWT request causes an HTTP 401 (Unauthorized) response. You can use the GET /auth_token/extend request to obtain a refreshed JWT.