Authentication
Learn how to securely authenticate with the MediBridgeX platform using API Keys and organization-based access.
Overview
Every request to the MediBridgeX platform requires authentication. Authentication is organization-aware. Projects inherit permissions from organizations, and API Keys are scoped strictly to projects.
Authentication Flow
Authorization Header
All authenticated requests use the Authorization header. Use placeholder values for testing. Never expose real credentials in client-side code or public repositories.
Working With API Keys
Generate
Create scoped API keys per project.
Rotate
Regularly replace old keys with new ones.
Revoke
Instantly disable compromised keys.
Scope
Limit key access to specific resources.
Organizations
Organizations are the highest-level security boundary in MediBridgeX. They own Projects, Members, API Keys, and all Resources associated with them.
Projects
Projects isolate integrations. Each project maintains independent credentials, webhooks, and configuration to safely separate development stages.
Healthcare Integration
Live clinical data workflows.
Sandbox
Safe testing environment.
Production
Mission-critical live systems.
Best Practices
Authentication Errors
The API key is missing or invalid.
Action: Provide a valid Bearer token in the header.
The API key lacks permissions.
Action: Check your project and key scopes.
The API key has passed its expiration date.
Action: Generate a new API key in the dashboard.
The API key format is incorrect or revoked.
Action: Ensure you copied the entire key string.
The Authorization header was not sent.
Action: Add the Authorization header to your request.
Too many requests were sent using this key.
Action: Implement exponential backoff or upgrade plan.
Example Request
// Headers
Authorization: Bearer YOUR_API_KEY
Accept: application/fhir+json
Content-Type: application/fhir+json
// Response (200 OK)
{
"resourceType": "Patient",
"id": "12345",
"active": true
}