Get started · RxPhoto

Authentication — RxPhoto

The RxPhoto (RxP) API authenticates with a single token sent as an Authorization header on every request, prefixed with Token (for example Authorization: Token YOUR_TOKEN). You obtain that token by posting credentials to an authenticate endpoint. There is no gateway apikey and no HTTP Basic encoding.

📎 Using PNE or VISH instead?

PNE and VISH use a different scheme — a gateway apikey query parameter plus HTTP Basic user credentials. See Authentication — PNE & VISH →

The auth scheme

Every RxP request carries one credential: an Authorization header containing your token.

The token is checked per request (the API is stateless).
Authenticated calls run with the permissions associated with that token.
A missing or invalid token returns 401 Unauthorized.
A valid token that lacks access to the requested resource returns 403 Forbidden.

⚠️ Always use HTTPS

Your token travels in the header of every request. Only call the API over https:// so it is never sent in clear text. Keep it out of source control, logs, and browser code shipped to end users. Rotate it immediately if it is ever exposed.

Getting a token

Exchange a username and password for a token by posting to the user authenticate endpoint. The response includes a token field — that value is what you send on every subsequent request.

curl -X POST "https://api.rxphoto.com/api/v3/authenticate/user/" \
  -H "Content-Type: application/json" \
  -d '{"username": "user@example.com", "password": "YOUR_PASSWORD"}'

# Response (abridged):
# { "token": "YOUR_TOKEN", "user": { ... } }

const base = "https://api.rxphoto.com/api/v3";

const res = await fetch(`${base}/authenticate/user/`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ username: "user@example.com", password: "YOUR_PASSWORD" }),
});
const { token } = await res.json();

import requests

base = "https://api.rxphoto.com/api/v3"
res = requests.post(f"{base}/authenticate/user/", json={
    "username": "user@example.com",
    "password": "YOUR_PASSWORD",
})
token = res.json()["token"]

using System.Net.Http;
using System.Net.Http.Json;

var http = new HttpClient { BaseAddress = new Uri("https://api.rxphoto.com/api/v3/") };
var res = await http.PostAsJsonAsync("authenticate/user/", new {
    username = "user@example.com",
    password = "YOUR_PASSWORD",
});
var body = await res.Content.ReadFromJsonAsync<Dictionary<string, object>>();
var token = body["token"];

📎 Other authenticate endpoints

The reference lists several sign-in endpoints under /api/v3/authenticate/… (for example user/, doctor/, patient/, client/). Use the one that matches the account type you are signing in. See the RxPhoto reference for the full list and each request body.

Using your token

Send the token in the Authorization header on every request. Set it once on your HTTP client so you don't have to repeat it:

curl "https://api.rxphoto.com/api/v3/doctor/me/" \
  -H "Authorization: Token YOUR_TOKEN"

const base = "https://api.rxphoto.com/api/v3";
const authHeader = { Authorization: "Token YOUR_TOKEN" };

// Reuse authHeader on every fetch:
const res = await fetch(`${base}/doctor/me/`, { headers: authHeader });

import requests

base = "https://api.rxphoto.com/api/v3"
# A session with the token as a default header keeps every call clean:
s = requests.Session()
s.headers.update({"Authorization": "Token YOUR_TOKEN"})

res = s.get(f"{base}/doctor/me/")

using System.Net.Http;

var http = new HttpClient {
  BaseAddress = new Uri("https://api.rxphoto.com/api/v3/")
};
http.DefaultRequestHeaders.Add("Authorization", "Token YOUR_TOKEN");

// Every subsequent call carries the token automatically:
var res = await http.GetAsync("doctor/me/");

📎 No Base64, no gateway key

Unlike PNE/VISH, RxPhoto does not use HTTP Basic encoding and has no gateway apikey parameter. Prefix your token value with Token in the Authorization header (for example Authorization: Token YOUR_TOKEN) — it is a Token scheme, not Basic or Bearer .

ℹ️ Keeping a token alive

A lightweight GET /api/v3/ping/ exists to extend the token's expiry without doing real work — handy for long-lived sessions.

Base URL

The RxPhoto base URL, with most endpoints under the /api/v3/ path:

https://api.rxphoto.com/api/v3/...

API	Base URL	Auth mechanism
RxPhoto (RxP)	`https://api.rxphoto.com`	`Authorization: Token YOUR_TOKEN` header
PatientNow Pro (PNP)	`https://backend-production.patientnow.net/backend/patientnowpro`	`Authorization: YOUR_TOKEN` header
PNE / VISH	`https://api.envisiongo.com/api/v1`	`?apikey=…` + `Authorization: Basic …`

Common 401 and 403 causes

Response	Likely cause	Fix
`401` on every call	Missing `Authorization` header, or token value is empty/invalid	Confirm the header is present and that the token value is correct.
`401` after it worked before	Token expired or revoked	Re-authenticate to get a fresh token, or call `/api/v3/ping/` to keep it alive.
`401` at sign-in	Username and/or password do not match	Check the credentials, or reset the password.
`403` at sign-in	Account inactive or blocked	Contact your administrator to reactivate the account.
Works in cURL, fails in code	Header stripped by a proxy, redirect, or CORS preflight	Call the canonical `https` URL directly; check that the header survives redirects.

Pre-flight checklist

✅ Calling over https://
✅ Base URL is https://api.rxphoto.com
✅ Obtained a token from POST /api/v3/authenticate/user/
✅ Authorization: Token YOUR_TOKEN header present on every request
✅ Token is kept out of source control and logs

← Auth — PNE & VISH Next: Guides & concepts →