Get started

Authentication

Authenticate securely with Mediloop APIs using the credential and OAuth flow appropriate to your integration.

Open API Explorer

Authentication options

API / service credentials

For approved machine-to-machine and partner integrations where supported.

OAuth 2.0

Delegated API authorization with least-privilege scopes.

OpenID Connect

Application sign-in and identity claims through Mediloop Identity & SSO.

Authentication proves the caller's identity. Authorization is evaluated separately from scopes, tenant membership, roles and resource-level rules.

Access tokens

Bearer token

GET /v1/appointments HTTP/1.1
Host: sandbox.api.mediloop.com
Authorization: Bearer $MEDILOOP_ACCESS_TOKEN
Accept: application/json

Access tokens are short-lived. Use the supported refresh or service-token mechanism for your client type instead of persisting access tokens indefinitely.

Tenant context

Tenant-aware request

curl https://sandbox.api.mediloop.com/v1/appointments \
  -H "Authorization: Bearer $MEDILOOP_ACCESS_TOKEN" \
  -H "X-Tenant-Id: $TENANT_ID" \
  -H "X-Membership-Id: $MEMBERSHIP_ID"

Context headers are hints to select the active authorization context. The backend must validate that the authenticated subject actually owns an active membership in that tenant; clients cannot grant themselves access by supplying a header.

Scopes

Example scope	Purpose
prescriptions.read	Read permitted prescription resources
appointments.write	Create or update appointments
marketplace:write	Manage eligible marketplace resources
healthcare.read	Read approved healthcare/FHIR resources

Security best practices

Keep secrets in a server-side secret manager.

Use PKCE for public browser/mobile OAuth clients.

Request the minimum scopes required.

Validate issuer, audience, expiry and state/nonce where applicable.

Rotate or revoke credentials immediately on suspected compromise.

Never derive tenant/resource access from identity claims alone.

Errors

HTTP	Meaning
401	Missing, invalid or expired authentication
403	Authenticated but not authorized for the requested tenant/resource/scope
429	Rate limit exceeded

For professional SSO, regional identity and OIDC details, see Identity & SSO →