Personal Access Tokens for API and Integrations

Personal Access Tokens (PATs) are the recommended way to authenticate with the Navigatr API. They replace the previous short-lived bearer token approach and give you named, revocable tokens you can manage from your account settings, so you never need to share your account password with third-party tools.

This guide explains how to generate a token, use it in direct API calls, and connect it to tools like Zapier and Moodle.

Prerequisites

• A Navigatr account. Learner, provider admin, and community admin accounts can all generate tokens. Start a free trial if you do not have one yet.

1. Create a Personal Access Token

1. Log in to your Navigatr account.
2. Go to User Settings → Personal Access Tokens.
3. Click  Create Token.
4. Give the token a descriptive name — for example, Zapier – badge issuing or Moodle plugin. This makes it easy to identify and revoke later.
5. Copy the token immediately. It is only shown once. Store it somewhere safe, such as a password manager or your platform's secrets store.

You can create multiple tokens, one per integration, so revoking one does not affect the others.

2. Use your token with the API

Pass your token in the Authorization header as a Bearer token on every API request. Here is an example for issuing a badge with the API.

curl -X PUT "https://api.navigatr.app/v1/badge/51/issue"   -H "Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN"   -H "Content-Type: application/json"   -d '{
        "recipient_firstname": "Jane",
        "recipient_lastname":  "Smith",
        "recipient_email":     "jane.smith@example.com"
      }'

Replace YOUR_PERSONAL_ACCESS_TOKEN with your token. A successful response returns 200 OK with the issued badge object.

See the full API reference for all available endpoints and request formats.

3. Code examples

Python (requests)

import requests, os

PAT = os.getenv("NAVIGATR_TOKEN")  # store your token as an environment variable

response = requests.put(
    "https://api.navigatr.app/v1/badge/51/issue",
    headers={
        "Authorization": f"Bearer {PAT}",
        "Content-Type": "application/json"
    },
    json={
        "recipient_firstname": "Jane",
        "recipient_lastname": "Smith",
        "recipient_email": "jane.smith@example.com"
    }
)
print(response.status_code, response.json())

JavaScript (fetch / Node)

const PAT = process.env.NAVIGATR_TOKEN; // store your token as an environment variable

const res = await fetch("https://api.navigatr.app/v1/badge/51/issue", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${PAT}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    recipient_firstname: "Jane",
    recipient_lastname:  "Smith",
    recipient_email:     "jane.smith@example.com"
  })
});

console.log(await res.json());

4. Connect to Zapier

When adding Navigatr as an action in Zapier, you will be asked to connect your account. Use your Personal Access Token when prompted for an API key or token.

1. In your Zap, select Navigatr as the action app.
2. When prompted to connect an account, paste your Personal Access Token into the API Key field.
3. Continue setting up your Zap as normal.

For a full walkthrough of badge issuing through Zapier, see Getting Started with Zapier and Navigatr.

5. Connect to Moodle

The Navigatr Moodle plugin uses your Personal Access Token to issue badges automatically when learners complete a course.

1. In Moodle, go to Site administration → Plugins → Local plugins → Navigatr.
2. Paste your Personal Access Token into the Personal Access Token field.
3. Click Test Connection to confirm it is working.
4. Click Save Changes.

For full installation and badge mapping instructions, see Link your Navigatr Badges to a Moodle Course.

6. Manage and revoke tokens

You can view and delete all your tokens at any time from Settings → Personal Access Tokens.

• To revoke a token, click Delete next to it. Any integration using that token stops working immediately.
• If a token is ever compromised, revoke it straight away and generate a replacement.
• We recommend using one token per integration. That way, revoking one does not affect the others.

Tips

• Never put a token directly in your code or commit it to a repository. Use environment variables or a secrets manager.
• Name tokens clearly — Zapier – badge issuing is more useful six months from now than token1.
• A 401 response means the token is missing, invalid, or has been revoked. Check the value and generate a new one if needed.
• A 403 response means the token is valid but the account does not have permission for that action. Check the role of the account that generated the token.
• For batch issuing, loop through your learner list and call the endpoint once per record. The rate limit is five requests every two seconds on the public API.

Next Steps

• Read the full API reference for all endpoints and request formats.
• See Issuing Badges with Navigatr API for more detailed badge issuing examples.
• Book a call with our team if you are building a custom integration.
• Need help? Email support@navigatr.app and we will get you unstuck quickly.