Authentication
Secure your API requests using API keys and tokens.
Authentication
The Rehabify API uses API keys to authenticate requests. You can manage your API keys in the Partner Portal under Developer Settings.
API Key Types
We provide two pairs of API keys for each organization:
| Key Prefix | Scope | Usage |
|---|---|---|
pk_test_... | Public Key (Sandbox) | Used in frontend apps, mobile widgets, and embed scripts for testing. |
sk_test_... | Secret Key (Sandbox) | Used for backend API requests in testing and staging environments. |
pk_live_... | Public Key (Production) | Used in production frontend widgets and client applications. |
sk_live_... | Secret Key (Production) | Used for live production server-to-server API calls. |
Authorizing Requests
Authenticate your API requests by including your secret API key in the Authorization header:
Code
Authorization: Bearer sk_live_99281a8c88f...Code
curl https://api.physioaroundme.com/api/v1/partners/providers \
-H "Authorization: Bearer sk_live_99281a8c88f..."Permission Scopes
Each API key can be scoped to specific permissions in the Partner Portal:
referrals:write: Create new patient referrals.referrals:read: Query referral status and tracking info.eligibility:check: Perform HMO and corporate member coverage checks.reports:read: Access clinical outcome notes and discharge PDFs.webhooks:manage: Add or modify webhook subscription endpoints.
Best Practices
[!WARNING] Never expose your Secret Key (
sk_live_...) in client-side code (browser JavaScript, mobile apps, or public GitHub repositories). All secret key requests must originate from your secure backend servers.
- Store Keys in Environment Variables: Use
.env.localor secret managers (e.g. AWS Secrets Manager, Doppler, Vault). - Rotate Compromised Keys: If a secret key is leaked, generate a new key in the Partner Portal and revoke the old one immediately.
- Use IP Whitelisting: For Enterprise partners, you can configure IP address restrictions on your secret keys in the Partner Dashboard.