Skip to main content
All API requests are authenticated with a bearer token in the Authorization header:

​
API tokens

API tokens are long-lived credentials for programmatic access. They start with the prefix pat_.
  • Issued per user. Every token belongs to a named user in your workspace. Actions taken with a token are attributed to that user and governed by that user’s roles and permissions.
  • Scoped to your workspace. A token only reaches data and resources in the workspace it was issued for.
  • Shown once. The token value is displayed a single time when it is created. Parable stores only a SHA-256 hash, so a lost token cannot be recovered, only replaced.
  • Revocable. Tokens can be revoked at any time without affecting other tokens or the owning user’s app access.
API tokens are currently provisioned by Parable for your workspace. Contact your Parable representative to request tokens for your team.

​
Sessions vs. tokens

Signing in to the Parable app creates a short-lived browser session. API tokens exist so your scripts, services, and BI tools do not depend on a browser session or its expiry. Use tokens for anything programmatic; use the app for interactive work.

​
Keeping tokens safe

  • Store tokens in a secret manager, not in code or config files.
  • Issue one token per integration so each can be revoked independently.
  • Revoke tokens when a teammate leaves or an integration is retired.
  • If a token leaks, revoke it immediately. Because only the hash is stored, revocation takes effect on the next request.

​
Errors