Authentication and access

Use a personal access token (PAT) for server-to-server integrations. Create and revoke tokens in the production portal. The portal uses phone sign-in with WhatsApp OTP.

Send the token

Authorization: Bearer rc_pat_REPLACE_WITH_YOUR_SECRET
Accept: application/json

The value above is a placeholder. A PAT is an opaque secret, not a JWT. Do not decode it or send it to SISPRO or PahFacturar. RipsCloud manages those connections.

Select permissions

Scope	Allows	Example
read	Read authorized resources	List packages and read dispatch attempts
write	Change authorized resources	Save a draft, create a revision, validate
send	Request supported external actions	Dispatch RIPS or emit a health document

Scopes do not include one another. A complete RIPS flow usually needs read + write + send. Give a read-only integration only read.

Each request also checks the user’s active membership and role. A token cannot give a user more access than their current account. Each token selects its workspaces and expires after the configured lifetime, from 1 to 365 days.

Keep administration in the portal

Token creation and revocation require an interactive session. A PAT cannot create another PAT. Workspace administration and upstream credentials also require the appropriate interactive role; they are excluded from this integration reference.

Use a separate token for each integration and environment. Revoke unused tokens. After revocation, expiry, removal of membership, or account deactivation, access can stop even if the secret has not changed.

Resolve access errors

• 401: verify the host and token. Check expiry and revocation. Obtain a new token through the portal if needed.
• 403 personal_access_token_scope_required: add the required scope through a replacement token.
• 403 personal_access_token_workspace_forbidden: use a workspace selected for that token.
• 403 workspace_membership_required: check the user’s current membership with the workspace administrator.
• personal_access_token_not_allowed: the operation requires an interactive session. Use the portal.

Never include a PAT in a support message. Share the HTTP status, error.code, and requestId instead.