Authentication
Authenticate your organization and scope requests to the correct Doctronic user.
The Doctronic API uses two request values with different responsibilities. User-scoped operations require both values.
Provisioning is managed by Doctronic
API tokens and related secrets are provisioned manually. Contact your Doctronic business or implementation contact for initial staging access, production credentials, rotation, or revocation.
| Request value | Purpose | Sent as |
|---|---|---|
| API token | Authenticates your organization | Authorization: Bearer … |
| Doctronic user ID | Selects the patient within your organization | X-Doctronic-User-ID: … |
API Bearer token
The API token is a server credential and must only be used from infrastructure you control.
Authorization: Bearer YOUR_API_TOKENDo not call the Doctronic API directly from browser JavaScript or a mobile application. Route requests through your backend so an end user cannot extract the token.
Doctronic does not currently provide a self-service credential dashboard. Coordinate token delivery and rotation with your Doctronic business or implementation contact using the agreed secure channel.
User scope
After creating a user, send the returned data.id with user-scoped requests:
X-Doctronic-User-ID: USER_ID_FROM_CREATE_RESPONSEThe user ID does not replace the Bearer token. Send both headers on every user-scoped request. Doctronic verifies that the selected user belongs to the authenticated organization. Changing the header cannot grant access to a user outside that scope.
Failure modes
401 error.auth.unauthorized: The Bearer token is missing, invalid, or inactive.403 error.member.forbidden: The authenticated organization cannot act on the selected user.404on scoped resources: The resource is missing or is outside the authenticated scope.
Keep environments separate
Staging and production credentials are distinct. Do not reuse tokens across environments.