Skip to main content
Every request carries an API key as a bearer token:
Keys are server-side secrets. Never put one in a browser, a mobile app or a public repository.

​
Two kinds of key

Personal key

Created by any clinician under Settings → API. It acts only as that clinician: patients and visits are theirs, with their templates and preferences. For a clinician’s own tools and scripts.

Organization key

Created by an organization admin under Organization → API, for a system many clinicians use — a clinic management system or HIS. Every patient and visit names its clinician with clinician_email.
With an organization key, the clinician must be a member of the organization with an RxNote account. If they are not, the request fails with 422 CLINICIAN_NOT_FOUND — invite them to the organization first. The visit is that clinician’s, and they review it in RxNote under their own login. Usage, limits and webhooks belong to the account: the organization, or the clinician when they have none.

​
Scopes

Give each key only what it needs. A request without the scope fails with 403 SCOPE_MISSING.

​
Test and live

Keys made on the sandbox (dev.rxnote.ai) or locally start rxn_test_ and never work on production; production keys start rxn_live_. Use synthetic patients only in the sandbox.

​
Rotating and revoking

Create the new key, deploy it, then revoke the old one in settings. A revoked key stops working within 30 seconds everywhere. Keys can also be given an expiry date when created. The secret is shown only once; RxNote stores a hash and cannot show it again.