/v1/* API requests require an API key passed in the Authorization header:
Getting Your API Key
API keys are managed through the Tenant Dashboard:- Sign in to the dashboard using your email (magic link authentication)
- Navigate to Settings → API Keys
- Click Create New Key and give it a descriptive name
- Copy and store the key securely — it’s only shown once
Test and live keys
A key is made in test or live mode. Test keys are not kept apart from live patient data yet, so a test key can manage webhooks (/v1/webhooks) but gets 403 TEST_KEY_NOT_ALLOWED on /v1/patients, /v1/assessments and /v1/fhir. Use a live key for those.
Webhook URLs
Webhook URLs must start withhttps://, use port 443 and point at a public host name. Addresses inside private networks are refused when you save the webhook and again before each delivery, and redirects are not followed.
Key Management Best Practices
- Store securely: Use a secrets manager like HashiCorp Vault or AWS Secrets Manager
- Rotate regularly: Create new keys periodically and revoke old ones
- Use descriptive names: Label keys by environment (e.g., “Production API”, “Staging”)
- Revoke compromised keys: If a key is exposed, delete it immediately from the dashboard
Using the SDK
The SDK automatically handles authentication when configured with your API key:Rate Limits
API keys are subject to rate limiting (100 requests per minute by default). If you exceed the limit, you’ll receive a429 Too Many Requests response.