Skip to main content

​
Create a key

An Org Admin creates a key under Settings → API Keys in the dashboard. The raw key is shown once and starts with dh_. Store it in a secret manager and use it only from a trusted server. Never put it in browser code, a mobile application, a URL, or a source repository.

​
Send the key

Send the key on every request. The recommended header is:
The following header is also supported:
Do not send a browser session cookie with an organization key. A request that presents more than one credential is refused.

​
What a key represents

A key authenticates the organization, not the person who created it. It carries call_logs.view and chat_logs.view and nothing else, and no lifecycle event on its creator (a role change, a password reset, a removed membership, a deleted account) changes what it reaches. Revoking the key is the only thing that stops it. To replace a key, create a new one, update your server’s secret, confirm a request, and then revoke the old key.

​
Tenant selection

Requests may name an organization or a workspace, through a header or a query parameter:
Selectors are optional because the key already identifies its organization. When supplied, they must match the key. A selector narrows; it never widens. Anything else is refused: a foreign caregiver, chat, call, phone number, workspace, or organization in a header, body field, query string, or path simply does not resolve.

​
When a request is refused

These refusals happen before the endpoint runs. They return 403 Forbidden with a detail message instead of the standard response envelope:
A record your organization does not own is not refused this way. It reads as “not found” in the standard envelope, so a caller is never told whether it exists in another organization.

​
What a key cannot do

Organization keys are refused on every route not in the API reference: key management, team and invitations, passwords, sub-organizations, workspaces, caregiver and patient management, platform configuration, audit logs, internal service routes, and impersonation. Those need a person signed in to the dashboard.