# Credentials and access This page lists what Peach issues you to access the platform and what each credential means. Peach provisions your first API key, your `companyId`, and your loan type IDs during onboarding — they are handed to you, not self-created through the public API. Use this page to identify each value before you make your first call. ## What Peach issues you Peach provisions these values for you, and your onboarding contact delivers them to you during kickoff. Treat every value below as an example format only — your real values arrive through your onboarding contact. | Credential | Example format | What it is and where you use it | | --- | --- | --- | | API key | `` | Authenticates your application to the public API. Sent on every request in the `X-API-KEY` header. | | `companyId` | `CP-AAAA-BBBB` | Identifies your company (the lender) in Peach. Appears in company-scoped paths and payloads. | | `loanTypeId` | `LT-AAAA-BBBB` | Identifies a configured loan type (the product template a loan is created from). Required when you create a loan; supplied as a filter on some list endpoints. | Loan type IDs are configured by Peach to match your program terms. You cannot list or create them through the public API — see [What you do not self-provision](#what-you-do-not-self-provision) below. Your onboarding contact delivers your loan type IDs together with your other credentials during kickoff. ## Authenticating API requests The public API authenticates with an API key sent in the `X-API-KEY` request header. Every request to a sandbox or production endpoint carries this header. ```http POST https://sandboxapi.peach.finance/api/people X-API-KEY: Content-Type: application/json ``` The API base URL differs between environments. Sandbox is `https://sandboxapi.peach.finance/api`. For the full list of hosts and how sandbox differs from production, see [Portals and environments](/getting-started/portals-and-environments). The spec also declares `oauth2` and `bearerAuth` schemes. Those back portal and session authentication, not the public integration path — your application uses `X-API-KEY`. ## API key fields An API key is an object with the following fields. Your key is tied to a single API version, and you can restrict it to specific IP addresses. | Field | Type | Description | | --- | --- | --- | | `key` | string | The API key value your application sends in the `X-API-KEY` header. | | `userId` | string | The user the key acts as. Required when a key is created. | | `companyId` | string | The company the key belongs to. | | `apiVersion` | string | The API version the key is pinned to, in `YYYY-MM-DD` format (for example, `2024-05-22`). A new key is created on the latest non-beta version unless a version is specified. | | `whitelistedIPs` | array | IP addresses or CIDR blocks allowed to use this key. Optional. | | `description` | string | An optional label for the key, 1–200 characters. | | `status` | string | `active` or `inactive`. | The full `key` value is returned only when you create a key: the create response carries the complete key, while listing keys, fetching a single key, and updating a key all return it masked — five asterisks followed by the last four characters (for example, `*****4444`). Save the key when you create it; the full value cannot be retrieved again afterward. Once you have a key, you can create additional keys and manage versions yourself. For rotating a key and moving it to a newer API version, see [API keys](/developer-tools/api-keys) and the [API keys reference](/api-docs/api-public/api-keys/). ## Portal access Peach also provides access to its web portals. These are separate from the API and use portal/session authentication rather than your API key. | Portal | Who uses it | What it is | | --- | --- | --- | | Admin Portal | Your configuration and engineering teams | Configure and inspect your program, including loan types and roles. | | Agent Portal | Your servicing and collections agents | Service accounts and manage borrower relationships. | | Borrower Portal | Your borrowers | White-label self-service for borrowers. | Portal URLs are provided to you during onboarding. Portal hostnames are configured per company rather than following a fixed public subdomain pattern. The addresses Peach provisions for you follow a naming form: in sandbox, `companyName-admin.peach-sandbox.finance`, `companyName-agent.peach-sandbox.finance`, and `companyName-borrower.peach-sandbox.finance`; production uses the same names with `-sandbox` removed. This is the form of the URLs you are given, not a pattern the platform enforces. For the environment hosts and the portal model in detail, see [Portals and environments](/getting-started/portals-and-environments). ## What you do not self-provision Some values are set up by Peach and are not created through the public API. Do not look for public endpoints to create them. | Value | How you get it | | --- | --- | | Loan types (`loanTypeId`) | Configured by Peach. There is no public endpoint to list or create loan types; `loanTypeId` appears in the public API only as a filter parameter. | | Portal users and roles | The public API does not expose a `/users` or user-role creation path. Portal users and their roles are managed in the Admin Portal. Company setup creates a single `super-admin-role`; there is no code-defined default borrower role. | ## See also - [Portals and environments](/getting-started/portals-and-environments) — The three portals and the sandbox and production hosts, next in the setup sequence. - [API keys](/developer-tools/api-keys) — How to rotate a key and move it to a newer API version. - [Core concepts](/getting-started/core-concepts) — The borrowers, loans, and loan types your credentials operate on.