Partner API Keys

AdministrationTenant adminLast updated:

This area is available to tenant administrators and global administrators.

The Partner API Keys sub-tab on Integrations lets you give an outside system — a health plan portal, a pharmacy platform, or another partner’s software — permission to read patient and prior authorization information from your tenant.

You manage keys from inside the tenant that owns them. Open your tenant from Tenant Management, or select the settings gear and choose Manage Tenant, then open the Integrations tab and select Partner API Keys.

How applications and keys fit together

An application represents one partner system. It holds:

  • The business units whose data the partner may read.
  • The permissions the partner is granted.
  • One or more keys the partner’s system uses to identify itself.

Keys and webhooks belong to an application, so revoking an application shuts off every key and webhook it owns at once. Keeping a separate application per partner means you can cut one partner off without disturbing the others.

Creating an application

  1. On the Integrations tab, open the Partner API Keys sub-tab.
  2. Select New Application.
  3. Fill in:
    • Application Name — How the partner system appears in your list, for example “Acme Member Portal”.
    • Business Units — Choose one or more top-level clients. Nested groups under a client are not listed. The partner can only ever see data from the clients you select here, and you can only select clients you have access to yourself.
    • Permissions — Select at least one:
      • Read patients — Look up a patient the partner already identifies.
      • Read prior authorizations — See the status of a prior authorization.
  4. Select Create.

The new application appears in the list with an Active chip and a chip for each permission you granted. It has no keys yet.

Grant only the permissions the partner actually needs. You can change them later by revoking the application and creating a new one with a narrower set.

Creating a key

  1. Select an application in the list to expand it.
  2. Select Create Key.
  3. Optionally enter a Label — a note that helps you tell keys apart later, such as “rotation 2026-09”.
  4. Select Create Key in the dialog.

The key appears immediately in a confirmation window.

The key is shown only once

The confirmation window is the only place the key is ever displayed. It cannot be looked up again afterwards, by you or by anyone else.

  • Select Copy Key to put it on your clipboard.
  • Hand it to the partner through their secret manager or another secure channel. Never send a key by email or chat.
  • Select I’ve Saved This Key to close the window.

If the key is lost before it reaches the partner, rotate it and pass along the replacement.

After you close the window, the key row shows a short key reference, its environment, its status, when it was created, and when the partner last used it. The key reference is a safe stand-in you can quote in a support conversation — it is not the key itself.

Rotating a key

Rotating replaces a key with a new one and switches off the old one straight away.

  1. Expand the application and find the key in the list.
  2. Select Rotate.
  3. Confirm in the dialog.

The replacement key is displayed once, in the same confirmation window as a newly created key. Copy it and give it to the partner right away — their system stops working until they switch to the new key.

If the partner needs time to change over without an outage, create a second key instead, let them deploy it, and then revoke the first one.

Revoking a key

  1. Expand the application and find the key in the list.
  2. Select Revoke.
  3. Confirm in the dialog.

The key stops working on the partner’s next request. The row stays in the list with a Revoked status so you keep a record of what existed.

Revoking an application

Select Revoke Application on an expanded application and confirm. Every key and webhook it owns stops working immediately and the partner loses all access.

Revoked applications are hidden by default. Turn on Show revoked applications at the bottom of the section to see them again.

Webhooks

Each application can have one or more webhooks that notify the partner when a prior authorization status changes. Webhooks appear below the keys table when you expand an application.

Adding a webhook

  1. Expand the application.
  2. Scroll to the Webhooks section and select Add Webhook.
  3. Fill in:
    • HTTPS URL — The partner’s public HTTPS endpoint that will receive signed notifications.
    • Description (optional) — A note to help you tell webhooks apart.
    • Prior authorization status changes — This event type is included by default.
    • Business Units (optional) — Limit which clients trigger notifications. Leave empty to use this application’s clients.
  4. Select Add Webhook.

The signing secret appears immediately in a confirmation window.

The signing secret is shown only once

The confirmation window is the only place the signing secret is ever displayed. It cannot be looked up again afterwards.

  • Select Copy Secret to put it on your clipboard.
  • Give it to the partner through their secret manager or another secure channel. Never send a secret by email or chat.
  • Select I’ve Saved This Secret to close the window.

If the secret is lost before it reaches the partner, rotate it and pass along the replacement.

Rotating a signing secret

  1. Expand the application and find the webhook in the Webhooks table.
  2. Select Rotate secret.
  3. Confirm in the dialog.

The new signing secret is displayed once, in the same confirmation window as a newly created webhook. Copy it and give it to the partner right away — their system will reject signatures made with the old secret.

Revoking a webhook

  1. Expand the application and find the webhook in the Webhooks table.
  2. Select Revoke.
  3. Confirm in the dialog.

Events stop being sent to that URL. The row stays in the list with a Revoked status when Show revoked applications is on.