Get started · PatientNow Pro

Authentication — PatientNow Pro

The PatientNow Pro (PNP) API authenticates with a single token sent as an Authorization header on every request. There is no gateway apikey and no HTTP Basic encoding.

📎 Using PNE or VISH instead?

PNE and VISH use a different scheme — a gateway apikey query parameter plus HTTP Basic user credentials. See Authentication — PNE & VISH →

The auth scheme

Every PNP request carries one credential: an Authorization header containing your token.

The token is checked per request (the API is stateless).
Authenticated calls run with the permissions associated with that token.
A missing or invalid token returns 401 Unauthorized.
A valid token that lacks access to the requested practice returns 403 Forbidden.

⚠️ Always use HTTPS

Your token travels in the header of every request. Only call the API over https:// so it is never sent in clear text. Keep it out of source control, logs, and browser code shipped to end users. Rotate it immediately if it is ever exposed.

Your token

Send your token in the Authorization header on every request. Set it once on your HTTP client so you don't have to repeat it:

curl "https://backend-production.patientnow.net/backend/patientnowpro/practices/YOUR_PRACTICE_ID/patients" \
  -H "Authorization: YOUR_TOKEN"

const base = "https://backend-production.patientnow.net/backend/patientnowpro";
const authHeader = { Authorization: "YOUR_TOKEN" };

// Reuse authHeader on every fetch:
const res = await fetch(`${base}/practices/${practiceId}/patients`, {
  headers: authHeader,
});

import requests

base = "https://backend-production.patientnow.net/backend/patientnowpro"
# A session with the token as a default header keeps every call clean:
s = requests.Session()
s.headers.update({"Authorization": "YOUR_TOKEN"})

res = s.get(f"{base}/practices/{practice_id}/patients")

using System.Net.Http;

var http = new HttpClient {
  BaseAddress = new Uri("https://backend-production.patientnow.net/backend/patientnowpro/")
};
http.DefaultRequestHeaders.Add("Authorization", "YOUR_TOKEN");

// Every subsequent call carries the token automatically:
var res = await http.GetAsync($"practices/{practiceId}/patients");

📎 No Base64, no gateway key

Unlike PNE/VISH, PNP does not use HTTP Basic encoding and has no gateway apikey parameter. Pass your token value directly in the Authorization header — no Basic or Bearer prefix is needed unless your token already includes one.

Base URL and practice ID

The PNP base URL is separate from the PNE/VISH host:

https://backend-production.patientnow.net/backend/patientnowpro

Every endpoint is then prefixed with your practice ID:

https://backend-production.patientnow.net/backend/patientnowpro/practices/{practiceId}/...

API	Base URL	Auth mechanism
PatientNow Pro (PNP)	`https://backend-production.patientnow.net/backend/patientnowpro`	`Authorization: YOUR_TOKEN` header
PNE / VISH	`https://api.envisiongo.com/api/v1`	`?apikey=…` + `Authorization: Basic …`

Common 401 and 403 causes

Response	Likely cause	Fix
`401` on every call	Missing `Authorization` header, or token value is empty/invalid	Confirm the header is present and that the token value is correct.
`401` after it worked before	Token expired or revoked	Re-issue or refresh your token.
`403` on a specific practice	Your token is valid but not authorized for that `practiceId`	Confirm the practice ID in the path matches a practice your token can reach.
Works in cURL, fails in code	Header stripped by a proxy, redirect, or CORS preflight	Call the canonical `https` URL directly; check that the header survives redirects.

Pre-flight checklist

✅ Calling over https://
✅ Base URL is https://backend-production.patientnow.net/backend/patientnowpro
✅ Authorization: YOUR_TOKEN header present on every request
✅ Practice ID in the path matches a practice your token is authorized for
✅ Token is kept out of source control and logs

← Auth — PNE & VISH Next: Guides & concepts →