Access and environments
Request credentials and keep staging and production integrations isolated.
Access is currently provisioned manually. Contact your Doctronic business or implementation contact to request credentials, rotate a secret, revoke access, or add a production integration. If you do not have a Doctronic contact yet, email business@doctronic.ai to start the conversation. Do not include credentials or patient information in email.
There is no self-service credential dashboard
Doctronic will coordinate credential delivery through the secure channel agreed with your organization. Do not send credentials through an unapproved messaging channel.
Base URLs
| Environment | Base URL | Use |
|---|---|---|
| Staging | https://staging-partners.doctronic.ai/api/v1 | Integration development and validation |
| Production | https://partners.doctronic.ai/api/v1 | Approved production traffic |
The legacy word partners remains in the current API hostnames, operation IDs, some wire-level
error values, and deprecated schema aliases retained for compatibility. In these docs,
organization means the authenticated business or product integrating with Doctronic.
Staging and production credentials are distinct. Keep separate secrets, configuration, user-ID mappings, logs, and deployment controls for each environment.
Request access
When contacting Doctronic, identify:
- Your organization and technical owner.
- The environment you need.
- The product flow you are building.
- Whether the integration includes conversations, artifacts, or appointments.
- Who should receive the credential through the agreed secure channel.
Confirm permitted staging data and the production-readiness process with your Doctronic business or implementation contact. The public API contract does not define a self-service approval workflow.
Store credentials
The Bearer token authenticates your organization. Store it in a server-side secret manager and inject it only into the backend service that calls Doctronic.
Authorization: Bearer YOUR_ORGANIZATION_TOKENDo not expose the token in browser code, mobile binaries, source control, client-visible configuration, logs, traces, screenshots, or analytics events.
For user-scoped endpoints, also send the Doctronic user ID returned by POST /users/:
X-Doctronic-User-ID: user-id-returned-by-doctronicThe /users/ resource is this Doctronic record scoped to your organization. Maintain an explicit
mapping between the record and the patient identity in your system. Do not accept a
client-supplied Doctronic user ID without verifying that mapping on your backend.
Rotate or revoke access
Coordinate rotation and revocation with your Doctronic business or implementation contact. Before a rotation, ensure your service can switch the stored secret without embedding it in a new client release. Afterward, verify a request in the target environment and remove the previous secret from your systems according to the agreed process.