Skip to main content
All /v1/* API requests require an API key passed in the Authorization header:

Getting Your API Key

API keys are managed through the Tenant Dashboard:
  1. Sign in to the dashboard using your email (magic link authentication)
  2. Navigate to Settings → API Keys
  3. Click Create New Key and give it a descriptive name
  4. Copy and store the key securely — it’s only shown once

Test and live keys

A key is made in test or live mode. Test keys are not kept apart from live patient data yet, so a test key can manage webhooks (/v1/webhooks) but gets 403 TEST_KEY_NOT_ALLOWED on /v1/patients, /v1/assessments and /v1/fhir. Use a live key for those.

Webhook URLs

Webhook URLs must start with https://, use port 443 and point at a public host name. Addresses inside private networks are refused when you save the webhook and again before each delivery, and redirects are not followed.

Key Management Best Practices

  • Store securely: Use a secrets manager like HashiCorp Vault or AWS Secrets Manager
  • Rotate regularly: Create new keys periodically and revoke old ones
  • Use descriptive names: Label keys by environment (e.g., “Production API”, “Staging”)
  • Revoke compromised keys: If a key is exposed, delete it immediately from the dashboard

Using the SDK

The SDK automatically handles authentication when configured with your API key:

Rate Limits

API keys are subject to rate limiting (100 requests per minute by default). If you exceed the limit, you’ll receive a 429 Too Many Requests response.