{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Credentials and access","siteUrl":"https://docs.peachfinance.com","description":"API and product documentation for Peach Finance, a lending-as-a-service platform."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"credentials-and-access","__idx":0},"children":["Credentials and access"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page lists what Peach issues you to access the platform and what each credential means. Peach provisions your first API key, your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["companyId"]},", and your loan type IDs during onboarding — they are handed to you, not self-created through the public API. Use this page to identify each value before you make your first call."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-peach-issues-you","__idx":1},"children":["What Peach issues you"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Peach provisions these values for you, and your onboarding contact delivers them to you during kickoff. Treat every value below as an example format only — your real values arrive through your onboarding contact."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Credential"},"children":["Credential"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example format"},"children":["Example format"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What it is and where you use it"},"children":["What it is and where you use it"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["API key"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["<YOUR-API-KEY>"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authenticates your application to the public API. Sent on every request in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-KEY"]}," header."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["companyId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CP-AAAA-BBBB"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies your company (the lender) in Peach. Appears in company-scoped paths and payloads."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loanTypeId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["LT-AAAA-BBBB"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies a configured loan type (the product template a loan is created from). Required when you create a loan; supplied as a filter on some list endpoints."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Loan type IDs are configured by Peach to match your program terms. You cannot list or create them through the public API — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#what-you-do-not-self-provision"},"children":["What you do not self-provision"]}," below. Your onboarding contact delivers your loan type IDs together with your other credentials during kickoff."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authenticating-api-requests","__idx":2},"children":["Authenticating API requests"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The public API authenticates with an API key sent in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-KEY"]}," request header. Every request to a sandbox or production endpoint carries this header."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"POST https://sandboxapi.peach.finance/api/people\nX-API-KEY: <YOUR-API-KEY>\nContent-Type: application/json\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The API base URL differs between environments. Sandbox is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://sandboxapi.peach.finance/api"]},". For the full list of hosts and how sandbox differs from production, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/getting-started/portals-and-environments"},"children":["Portals and environments"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The spec also declares ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["oauth2"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["bearerAuth"]}," schemes. Those back portal and session authentication, not the public integration path — your application uses ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-KEY"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"api-key-fields","__idx":3},"children":["API key fields"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An API key is an object with the following fields. Your key is tied to a single API version, and you can restrict it to specific IP addresses."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The API key value your application sends in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-KEY"]}," header."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["userId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The user the key acts as. Required when a key is created."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["companyId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The company the key belongs to."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["apiVersion"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The API version the key is pinned to, in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["YYYY-MM-DD"]}," format (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["2024-05-22"]},"). A new key is created on the latest non-beta version unless a version is specified."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["whitelistedIPs"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["array"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["IP addresses or CIDR blocks allowed to use this key. Optional."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["description"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An optional label for the key, 1–200 characters."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["status"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["active"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["inactive"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The full ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["key"]}," value is returned only when you create a key: the create response carries the complete key, while listing keys, fetching a single key, and updating a key all return it masked — five asterisks followed by the last four characters (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*****4444"]},"). Save the key when you create it; the full value cannot be retrieved again afterward."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once you have a key, you can create additional keys and manage versions yourself. For rotating a key and moving it to a newer API version, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/developer-tools/api-keys"},"children":["API keys"]}," and the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/api-docs/api-public/api-keys/"},"children":["API keys reference"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"portal-access","__idx":4},"children":["Portal access"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Peach also provides access to its web portals. These are separate from the API and use portal/session authentication rather than your API key."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Portal"},"children":["Portal"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Who uses it"},"children":["Who uses it"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What it is"},"children":["What it is"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Admin Portal"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your configuration and engineering teams"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Configure and inspect your program, including loan types and roles."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent Portal"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your servicing and collections agents"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Service accounts and manage borrower relationships."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Borrower Portal"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your borrowers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["White-label self-service for borrowers."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Portal URLs are provided to you during onboarding. Portal hostnames are configured per company rather than following a fixed public subdomain pattern. The addresses Peach provisions for you follow a naming form: in sandbox, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["companyName-admin.peach-sandbox.finance"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["companyName-agent.peach-sandbox.finance"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["companyName-borrower.peach-sandbox.finance"]},"; production uses the same names with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["-sandbox"]}," removed. This is the form of the URLs you are given, not a pattern the platform enforces. For the environment hosts and the portal model in detail, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/getting-started/portals-and-environments"},"children":["Portals and environments"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-you-do-not-self-provision","__idx":5},"children":["What you do not self-provision"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Some values are set up by Peach and are not created through the public API. Do not look for public endpoints to create them."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"How you get it"},"children":["How you get it"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Loan types (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loanTypeId"]},")"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Configured by Peach. There is no public endpoint to list or create loan types; ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loanTypeId"]}," appears in the public API only as a filter parameter."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Portal users and roles"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The public API does not expose a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/users"]}," or user-role creation path. Portal users and their roles are managed in the Admin Portal. Company setup creates a single ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["super-admin-role"]},"; there is no code-defined default borrower role."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"see-also","__idx":6},"children":["See also"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/getting-started/portals-and-environments"},"children":["Portals and environments"]}," — The three portals and the sandbox and production hosts, next in the setup sequence."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/developer-tools/api-keys"},"children":["API keys"]}," — How to rotate a key and move it to a newer API version."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/getting-started/core-concepts"},"children":["Core concepts"]}," — The borrowers, loans, and loan types your credentials operate on."]}]}]},"headings":[{"value":"Credentials and access","id":"credentials-and-access","depth":1},{"value":"What Peach issues you","id":"what-peach-issues-you","depth":2},{"value":"Authenticating API requests","id":"authenticating-api-requests","depth":2},{"value":"API key fields","id":"api-key-fields","depth":2},{"value":"Portal access","id":"portal-access","depth":2},{"value":"What you do not self-provision","id":"what-you-do-not-self-provision","depth":2},{"value":"See also","id":"see-also","depth":2}],"frontmatter":{"title":"Credentials and access","description":"The credentials and identifiers Peach issues a new client — API key, companyId, and loanTypeId — what each one is, and how the API key authenticates your requests.","verifiedDate":"2026-07-23T00:00:00.000Z","verifiedSpec":"api-keys.yml","verifiedRef":"peach@5e10825f3","seo":{"title":"Credentials and access"}},"lastModified":"2026-07-24T18:38:56.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/getting-started/credentials-and-access","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}