Skip to main content
PRIXO authenticates requests through session cookies. There are no API keys to generate or rotate — your session is established when you sign in through the web interface, and the browser handles the rest automatically. For programmatic access from a terminal or script, you extract the session cookie from your browser and pass it with each request.

​
How sessions work

When you sign in at prixo.ai, a secure HttpOnly session cookie is set in your browser. This cookie is sent automatically on every subsequent request from the same browser, including calls to the PRIXO API. Your session is refreshed on each request, so you rarely need to re-authenticate. For programmatic access outside a browser, you must first sign in through the web interface, copy your session cookie, and include it manually in your HTTP requests.

​
Sign-in methods

PRIXO supports two ways to authenticate:
  1. Phone OTP — Enter your Saudi phone number on the sign-in page and verify with the one-time passcode sent to you.
  2. Google OAuth — Click “Continue with Google” on the sign-in page and complete the Google sign-in flow. Your session is established automatically on return.

​
Making authenticated requests

Once you have a session cookie, include it in the Cookie header of your requests. The example below shows how to call the search endpoint from the command line after signing in through the browser:
Replace YOUR_SESSION_COOKIE with the full cookie string from your browser’s DevTools (Application → Cookies → prixo.ai).

​
Public vs. authenticated endpoints

Not every endpoint requires a session. Here is a quick reference: Public endpoints are read-only. You can call them freely without a session cookie to explore restaurants, compare prices, and browse trending queries.

​
Unauthorized responses

If you call an authenticated endpoint without a valid session, the API returns:
with HTTP status 401, or redirects you to /login depending on the request context. Re-authenticate through the web interface to obtain a fresh session cookie.

​
Session lifetime

Session management is fully automatic when you use PRIXO from a browser. Your session is refreshed on every request, so you stay signed in as long as you are active. For scripted access, refresh your cookie if you receive a 401 response — this means your session has expired and you need to sign in again.
PRIXO does not currently offer developer API keys or OAuth tokens for third-party integrations. The API is designed for browser-based usage. If you need server-to-server access, use a session cookie obtained from a signed-in browser session.
Never expose your session token in client-side JavaScript, public repositories, or application logs. A stolen session token grants full access to your account until it expires.