The API uses an API-key model. Keys are issued per clinic or partner and identify the integration on every request. Treat a key as a secret: never embed it in browser code or public repositories.
Each request carries the key in a request header. The exact header name is to be finalised at launch and will be documented here, along with any key prefix and rotation guidance.
The private application uses cookie and session authentication for clinic staff. That mechanism is internal to the app and is not part of this API. Public integrations use API keys only.
Request access from the API early-access form on the developer landing page.