Either use a secret, or don't expose the prisma-api directly through the firewall. Use a GraphQL server around it and then use the prisma-binding.