Authentication

Authenticate with a secret key sent as a Bearer token.

curl https://api.heyrafiki.space/v1/practitioners \
  -H "Authorization: Bearer sk_test_xxxxxxxxxxxxxxxx"

x-api-key is accepted as an alternative for clients that cannot set an Authorization header.

curl https://api.heyrafiki.space/v1/practitioners \
  -H "x-api-key: sk_test_xxxxxxxxxxxxxxxx"

Environments

Prefix	Environment	Access	Data
`sk_test_`	Sandbox	Approved projects	Fictitious records
`sk_live_`	Production	Enabled projects only	Regulated production data

A key is valid in one environment only. Using a sandbox key against production returns api_key_invalid.

Secret keys carry access to clinical and financial data. Never ship one to a browser, a mobile app, or a public repository.

Call the API from your server. Public clients get scoped tokens, never a secret key.
Store keys in your secret manager or environment, never in source control.
The built-in request runner accepts sandbox keys for inspection and does not persist them. Do not reproduce that pattern in a public client.
Revoke an exposed key and create its replacement in the Developer Platform.
Use HTTPS. If a key is sent over plain HTTP, treat it as compromised and replace it.

Last modified on August 14, 2026