Authentication

Pathway uses Personal Access Tokens for API authentication. A PAT belongs to one user inside one organization and begins with pat_.

Authorization: Bearer pat_your_token_here

Create a token

Open the Pathway app.
Click your organization name in the lower-left corner.
Open Settings and select Account.
Scroll to API Access Tokens and click New Token.
Name the token and choose whether it should be read-only.
Copy it before closing the dialog.

The raw token is displayed once. Pathway stores its SHA-256 hash and cannot show the original value again.

Choose the access level

Token	Use it for	Behavior
Read-write	Server integrations that submit or modify Books	GET and mutating requests are allowed according to the user’s organization role
Read-only	Reporting, internal analysis, and narrow data consumers	GET requests work; POST, PATCH, PUT, and DELETE return `403`

Submitting documents requires a read-write token.

Send the token

Include the token in the Authorization header on every request.

import requests

API_BASE = "https://api.lendpathway.com/api"
TOKEN = "pat_your_token_here"

headers = {
    "Authorization": f"Bearer {TOKEN}",
}

response = requests.get(
    f"{API_BASE}/auth/me",
    headers=headers,
    timeout=30,
)
response.raise_for_status()
print(response.json())

const API_BASE = "https://api.lendpathway.com/api";
const TOKEN = "pat_your_token_here";

const headers = {
  Authorization: `Bearer ${TOKEN}`,
};

const response = await fetch(`${API_BASE}/auth/me`, { headers });

if (!response.ok) {
  throw new Error(`${response.status}: ${await response.text()}`);
}

console.log(await response.json());

curl --fail-with-body \
  "https://api.lendpathway.com/api/auth/me" \
  -H "Authorization: Bearer pat_your_token_here"

Verify the token

GET /auth/me returns the identity attached to the credential.

class AuthMeResponse(BaseModel):
    org_id: str
    org_name: str
    user_id: str
    user_name: str

{
  "org_id": "c4f9dda9-7875-4115-961f-0ac4b9630526",
  "org_name": "Acme Funding",
  "user_id": "fa576914-9590-40af-bbb8-c3af6f500859",
  "user_name": "John Doe"
}

The token always acts inside the organization shown here. You do not need to send X-Org-Id with PAT requests. If you send it anyway, it must match the token’s organization.

Store it safely

Keep the token on your server. Do not place it in browser code, mobile application bundles, public repositories, logs, or screenshots. For deployed applications, read it from a secret manager or environment variable:

import os

TOKEN = os.environ["PATHWAY_API_TOKEN"]

Revoke a token

Return to Settings → Account → API Access Tokens, find the token by name or prefix, and click the delete icon. Revocation takes effect immediately. PATs do not expire on a timer. They remain valid until revoked, the user is removed, or the organization is deleted.

Authentication responses

Status	Meaning
`401`	The token is missing, malformed, invalid, or revoked
`403`	The token is valid but cannot perform this action or access the requested resource
`429`	The token exceeded the 30 requests-per-minute limit

Give each integration its own named token. Usage remains easier to identify and one integration can be revoked without interrupting the others.

Overview

Endpoints

Cookbook

Create a token

Choose the access level

Send the token

Verify the token

Store it safely

Revoke a token

Authentication responses

​Create a token

​Choose the access level

​Send the token

​Verify the token

​Store it safely

​Revoke a token

​Authentication responses

Create a token

Choose the access level

Send the token

Verify the token

Store it safely

Revoke a token

Authentication responses