Skip to content

PRISM GATEWAY

Sign inGet started

PRISM GATEWAY

Protect the source.
Control the access.

One credential. Isolated access.

Connect a provider credential once. Applications receive isolated virtual credentials—without exposing the original key.

Get startedLearn more

LIVE PATH · ILLUSTRATIVE

Provider credential
Key A
Key B
Key C
Key D

One protected provider credential. Prism issues isolated virtual credentials. The source is not split.

THE PROBLEM

One real key, copied everywhere.

Your real API key

Every application

Every developer

Every environment

One credential exposed everywhere

THE PRISM APPROACH

The source stays protected. Access is isolated.

The source credential stays protected. Applications receive isolated virtual credentials instead. The original provider key is not split into multiple keys.

  • The original credential remains encrypted.
  • Prism authenticates the virtual key.
  • Prism applies policy.
  • Prism retrieves the protected provider credential server-side.
  • Prism sends the authorized request upstream.

SOURCE

Real provider credential

CONTROL PLANE

Prism

Virtual Key A

Virtual Key B

Virtual Key C

Virtual Key D

Independent applications

HOW A REQUEST TRAVELS

Every request is gated before a provider is contacted.

APPLICATION

A downstream app sends a request with a virtual credential, never the original provider key.

CREDENTIAL VAULT

Your original key stays protected.

INGEST

Provider API key

ENCRYPTION BOUNDARY

Server-side only. The browser never sees the saved secret again.

Encrypted credential

NEON

Database

  • Never returned to the browser after saving
  • Never stored in plaintext in Neon
  • Not placed in URLs
  • Not placed in browser storage
  • Not included in analytics
  • Not included in audit logs
  • Decrypted server-side only when required

ENVELOPE ENCRYPTION

Encrypted before it is stored.

Provider credential

AES-256-GCM

Authenticated encryption

Encrypted credential

Per-credential DEK

Protected / wrapped key material

NEON

Database

BASIC

Your provider credential is encrypted before persistent storage.

ADVANCED

Open the advanced note for the current wrapping model and what is not claimed yet.

ISOLATED VIRTUAL KEYS

Revoke one application without rotating the source.

Revoking one virtual credential does not require replacing the underlying provider credential. Policies stay independent.

PROTECTED PROVIDER CREDENTIAL · STILL INTACT

App A → Virtual Key A

chat · 20 rpm

ACTIVE

App B → Virtual Key B

chat · 8 rpm

ACTIVE

App C → Virtual Key C

chat · 40 rpm

ACTIVE

App D → Virtual Key D

embeddings · 12 rpm

ACTIVE

CONTROL

Each virtual credential carries its own policy.

These controls are a demonstration of the policy surface. They do not change live vault data.

MODEL ACCESS

ENDPOINT ACCESS

Chat

Embeddings remain independently selectable in the product.

RATE LIMIT

20 requests / minute

TOKEN / REQUEST BUDGET

2,000 requests / day

EXPIRATION

Never expires until revoked

APPLICATION LABEL

Production

OPTIONAL IP RESTRICTIONS

None in this demonstration

SUPPORTED PROVIDERS

Adapters, not a generic open proxy.

Prism uses provider adapters so each provider's API behavior can be handled explicitly—authentication, model discovery, and request shaping stay allowlisted.

OpenAI

Official cloud API

Google Gemini

Official cloud API

Anthropic Claude

Official cloud API

DeepSeek

Official cloud API

Kimi / Moonshot

Official cloud API

Ollama

HTTPS endpoint only

CLOUD PROVIDERS

Prism

Provider API

REMOTE OLLAMA

Prism

Reachable HTTPS Ollama endpoint

Allowed only after DNS resolution and public-IP checks.

LOCAL-ONLY OLLAMA

Cloud-hosted Vercel gateway

Localhost / private network

Not reachable unless the architecture is self-hosted and the endpoint is network-accessible. Localhost is blocked.

SECURITY LAYERS

Protection is layered, not scored.

There is no fabricated security score. Each layer either is active, pending configuration, or explicitly not claimed.

REQUEST PIPELINE

Unauthorized traffic stops at the first failing gate.

A missing or revoked virtual key never reaches decryption.

Rejected requests are halted at the failing control. There is no synthetic security score.

AUDITABILITY

Events are recorded. Secrets are not.

Prism can provide visibility into virtual-key usage, request activity, revocations, authentication events, security events, and policy enforcement. Sensitive credentials and secrets are never placed into audit logs.

  1. VIRTUAL_KEY_CREATED

    NeonChat Production · no secret material

  2. PROVIDER_CONNECTED

    Google Gemini · ciphertext stored

  3. LOGIN_SUCCESS

    Verified session · hashed password unchanged

  4. VIRTUAL_KEY_REVOKED

    Website preview

  5. RATE_LIMIT_TRIGGERED

    Per-key window

  6. POLICY_DENIED

    Model family not allowed

WHY VIRTUAL KEYS

Isolate access instead of copying the source.

TRADITIONAL

One provider key

Everything

PRISM

Protected provider credential

Isolated virtual access

Application-specific control

TECHNICAL DEEP DIVE

Vercel in front. Neon for state.

Browser / Application
        ↓
Vercel
        ↓
Prism Gateway
        ├── Better Auth
        ├── Rate limiting
        ├── Policy engine
        ├── Credential vault
        ├── Provider adapters
        └── Audit system
        ↓
Neon PostgreSQL
        +
Upstash Redis

PRINCIPLES

Product rules, not slogans.

  1. 01Never expose the source credential
  2. 02Least privilege
  3. 03Isolate access
  4. 04Verify every request
  5. 05Minimize secret lifetime
  6. 06Log events, not secrets
  7. 07Fail closed on critical security controls

PRISM GATEWAY

Protect the source.
Control the access.

Start building with isolated credentials.

Get startedExplore security