> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.superpath.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Getting started with SuperPath API


# Getting started with SuperPath API

**In this article:**
* Overview
* Step 1: Get a SuperPath account
* Step 2: Generate your API key
* Step 3: Make your first request
* Step 4: Build your integration
* Things to keep in mind
* FAQs

## Overview
This article walks you from a standing start to your first authenticated call against the SuperPath API. You'll need a SuperPath account on a **paid plan**, because API keys are a paid-plan feature, and someone with the **Owner** or **Admin** role to generate the key for you in the app.

The API has a base path of `https://api.superpath.io` and authenticates with a bearer token, so there's nothing to install — any HTTP client will do.

## Step 1: Get a SuperPath account
You'll need a SuperPath account in order to access the SuperPath API. [Sign Up](https://app.superpath.io/signup) or [Contact us](https://www.superpath.io/contact-us) and one of our Sales Representatives will get in touch to help you set up your account.

## Step 2: Generate your API key
API keys are generated in the app, under **Settings → Integrations**, in the **API keys** section. For the full click-through, see the help article *How to Generate an API Key*.

Two things to know before you start:

| Point | Detail |
|---|---|
| Who can generate a key | Only **Owners** and **Admins** — Settings pages aren't available to other roles. |
| What the key can access | The key is generated against a SuperPath user, and requests made with it get that user's permissions in that user's account. |

The key is shown to you **once**, when it's created. Copy it and store it somewhere secure — it can't be retrieved later, and if it's lost you'll need to generate a new one.

## Step 3: Make your first request
Send your key as a bearer token in the `Authorization` header. This call lists the Users in your account:

```bash
curl https://api.superpath.io/users \
  -H "Authorization: Bearer YOUR_API_KEY"
```

The same request in JavaScript:

```js
const response = await fetch('https://api.superpath.io/users', {
  headers: {
    Authorization: `Bearer ${process.env.SUPERPATH_API_KEY}`,
  },
});

const users = await response.json();
```

A `200` response with a JSON array means you're authenticated and ready to go. A `401` means the key is missing, unrecognised, revoked, or belongs to a user whose role isn't allowed to make that call — see [Learn how to authenticate with the SuperPath API](https://help.superpath.io/en/article/learn-how-to-authenticate-with-the-superpath-api-5xo64k/) for the full list of authentication responses.

## Step 4: Build your integration
Build your integration using our [API Reference documentation](https://superpath.readme.io/reference), which lists every endpoint, request body and response schema.

Worth reading before you go to production:

* [Learn about API rate limits and how to work with them](https://help.superpath.io/en/article/learn-about-api-rate-limits-and-how-to-work-with-them-1dr37nb/) — how to pace your requests and back off gracefully.
* [Learn how to handle and recover from errors received from the SuperPath API](https://help.superpath.io/en/article/learn-how-to-handle-and-recover-from-errors-received-from-the-superpath-api-grdos3/) — the status codes we return and what to do about them.
* [Webhooks - Get updates in real-time](https://help.superpath.io/en/article/webhooks-get-updates-in-real-time-19fivqo/) — so you don't have to poll for changes.

If you need any help please contact our team at [support@superpath.io](mailto:support@superpath.io). We're always willing to help, and keen to hear feedback on how our APIs can be improved.

## Things to keep in mind
* API access is only available on paid accounts. On a free plan the **API keys** section shows a message pointing you to your **Billing settings** to upgrade.
* Keep the key server-side. Anyone who has it can act on your account with the permissions of the user it was generated for, so never ship it in client-side code or commit it to a repository.
* Generate a separate key per integration and give each one a name, so you can revoke one without breaking the others. See the help article *How to Revoke an API Key*.
* We reserve the right to remove older APIs and functionality with a 3-month deprecation notice, so keep an eye on the reference documentation as you build.

## FAQs
**Do I need a separate developer account or app registration?**
No. There's no separate developer portal or OAuth app to register — a paid SuperPath account plus an API key is all you need.

**Can I get a test environment?**
Contact us and we can look to provide a test account for you to use.

**Which SuperPath user should the key belong to?**
One whose role has exactly the access your integration needs. Requests made with the key inherit that user's permissions, so a key generated against a highly privileged user can do everything that user can.