Obtain a Token

Every request (except this one) is authorized with a JWT in the Authorization header. Exchange your API key for a token at /jwt/token:

Request:

curl -i -X POST \
  https://sandbox-api.pathly.io/jwt/token \
  -H 'Content-Type: application/json' \
  -d '{
    "merchant_id": "ec7e1848-dc80-4ab0-8827-dd7fc0737b43",
    "key": "sk_uFAaQdJTDLVg8S7cloi9r1Wpk6430tyB"
  }'

Your merchant ID and Secret Key are on your developer dashboard (https://sandbox.pathly.io/developers). Use the Secret Key (sk_…) for server-to-server calls.

Response:

{
  "status": "success",
  "data": {
    "token": "i1qxz68gu50zp4i8ceyxqogmq7y0yienm52351c6...",
    "expires_in": 900
  },
  "code": 200,
  "message": "Successful request"
}

Store the token and send it as Authorization: Bearer <token> on subsequent requests. Tokens expire after expires_in seconds; request a new one when it lapses.

For full request and response details, see the Create an access token API reference.

Acting for your players

Your Secret Key authorizes actions for your account — creating players, charging cards, and paying winnings (where your merchant account is the source).

Pathly enforces control of source, so the two player-side steps — funding a wallet from the player's own bank, and cashing out — must be performed as the player. You don't need a separate player login: a transfer's actor is the owner of its source, and because you onboarded the player you may act for them. Set the source to one of the player's handles — their account (source_account, addressing their wallet) when cashing out, or their bank (source_payment_method) when funding. Pathly authorizes the call through the onboarding relationship (you may only act for accounts you onboarded) and runs it as the player, not your platform.