Authentication
Authenticate your API requests using Bearer tokens. All requests must include a valid API key.
Bearer Token
Include your API key in the Authorization header of every request:
Authorization: Bearer rlya_live_abc123def456API Key Types
| Prefix | Environment | Description |
|---|---|---|
| rlya_live_ | Production | Access to live patient data and operations |
| rlya_test_ | Sandbox | Safe testing environment with mock data |
Scopes
API keys can be restricted to specific scopes. Assign only the permissions your integration needs.
| Scope | Access |
|---|---|
| appointments:read | List and retrieve appointments |
| appointments:write | Create, update, and cancel appointments |
| patients:read | List and retrieve patient records |
| patients:write | Create and update patient records |
| voice:read | Access call logs and transcripts |
| voice:write | Initiate and transfer calls |
| scribe:read | Retrieve clinical notes |
| scribe:write | Submit audio and approve notes |
| webhooks:manage | Create and delete webhook subscriptions |
| analytics:read | Access analytics and reporting data |
Security Best Practices
- Never expose API keys in client-side code or public repositories.
- Use environment variables to store keys in your application.
- Rotate keys periodically and revoke any that may have been compromised.
- Assign the minimum scopes required for your integration.
- Use sandbox keys (
rlya_test_) during development and testing.