Skip to main content

​
Overview

The Operahealth API uses API key authentication. All requests must include a valid API key in the Authorization header using the Bearer scheme. 
Authorization: Bearer opera_live_a1b2c3d4e5f6...

​
API Key Format

API keys follow a specific format based on environment:
EnvironmentExample
Productionopera_live_a1b2c3d4e5f6...
Developmentopera_demo_a1b2c3d4e5f6...

​
Managing API Keys

API keys are managed through your Operahealth dashboard at Settings → API Keys.

​
Creating a Key

1

Log in to your dashboard

Navigate to your Operahealth dashboard and log in with your credentials.
2

Go to API Keys

Navigate to Settings → API Keys.
3

Create a new key

Click Create API Key and give it a descriptive name (e.g., “Production Integration” or “Development Integration”).
4

Copy and store securely

Copy the key immediately — it won’t be shown again. Store it securely in an environment variable or secrets manager.
Store your API key securely. Once created, the full key cannot be retrieved again. If you lose it, you’ll need to create a new one.

​
Revoking a Key

Keys can be revoked instantly from the dashboard. Once revoked, any requests using that key will immediately return 401 Unauthorized.

​
Security Best Practices

  • Never commit keys to version control - Never expose keys in client-side code - Use environment variables or a secrets manager
API keys must only be transmitted over secure HTTPS connections. The API will reject non-HTTPS requests.
Periodically revoke old keys and create new ones, especially if team members leave or keys may have been exposed.
Use separate keys for different integrations. This makes it easier to track usage and revoke access for specific integrations without affecting others.

​
Example Request

  • Production
  • Development
const response = await fetch(
  "https://api.prod.operahealth.ai/api/v1/patients",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer opera_live_your_api_key_here",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      firstName: "John",
      lastName: "Doe",
      phoneNumber: "+61412345678",
      email: "john@example.com",
    }),
  }
);

​
Authentication Errors

StatusErrorDescription
401Missing API keyNo Authorization header provided
401Invalid API keyKey format is incorrect or key doesn’t exist
401Revoked API keyKey has been revoked in the dashboard
403Insufficient permissionsKey lacks required permissions (future)
Example 401 Response
{
  "type": "about:blank",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Missing or invalid API key",
  "instance": null
}