Authentication
API keys, live and test keys, and keeping keys out of browsers.
Send your key in the Authorization header on every /v1 request:
Authorization: Bearer hdev_live_ab12cd34_...The MCP server also accepts x-api-key: hdev_live_....
Live and test keys
| Prefix | Data | Limits | Billed |
|---|---|---|---|
hdev_live_ | All | Your plan's limits | Yes |
hdev_test_ | Same data | 2 requests/s, 1,000 calls/month | Never |
Public endpoints
/v1/status, /healthz and /openapi.json need no key.
Handling keys
- Keys are shown once. We store only a salted hash and a short public prefix (
hdev_live_ab12cd34) so you can tell keys apart in the dashboard. - Keep keys on your server. Never ship a live key in browser or mobile code.
- Revoke a leaked key in the dashboard; revocation takes effect within 30 seconds.
Errors
A missing, malformed or revoked key returns 401 with type
https://healthcare.dev/problems/unauthorized. See Errors.