Authentication

API Keys

There are two types of API keys:

Obtaining API Keys

1. Sign up at developers.mediloop.co
2. Create an application
3. Generate API keys from the dashboard

Making Authenticated Requests

Include your API key in the Authorization header using Bearer authentication:

curl https://api.mediloop.co/api/v1/patients \
  -H "Authorization: Bearer sk_test_51RHO58...T100WQd9N1qn" \
  -H "Content-Type: application/json"

{
  "object": "list",
  "url": "/api/v1/patients",
  "has_more": false,
  "data": [
    {
      "id": "pat_1234567890",
      "object": "patient",
      "uhid": "UG123456789A"
    }
  ]
}

Request Headers

API Key Security

Your API keys carry many privileges, so be sure to keep them secure:

• Never expose keys in client-side code - API keys should only be used server-side
• Don't commit keys to version control - Use environment variables
• Rotate keys regularly - Generate new keys periodically
• Use restricted keys - Create keys with limited permissions when possible

Key Rotation

You can roll your API keys at any time from the Developer Portal:

1. Navigate to API Keys
2. Click "Roll Key" on the key you want to rotate
3. The old key will be invalidated after 24 hours

Restricted Keys

For enhanced security, you can create restricted API keys with specific permissions:

{
  "name": "Read-only Patient Access",
  "permissions": {
    "patients": ["read"],
    "encounters": ["read"],
    "observations": ["read"]
  }
}

Error Responses

Authentication errors return a 401 Unauthorized status:

{
  "error": {
    "code": "authentication_error",
    "message": "Invalid API key provided",
    "type": "invalid_request_error"
  }
}

Related