API Keys
Create, scope, and rotate the keys that authenticate against the careCycle API.
API keys live at Settings > Developer > API Keys (developer settings permission required). Every key belongs to your organization, so it survives staff changes.
Creating a Key
Creation is two steps. First, configure:
- Name: what this key is for ("Vendor X ping-post", "BI export").
- Expiration: never, or 1 day, 7 days, 30 days, or 1 year.
- Permissions: any combination of Read (GET queries), Write (create, update, delete), and Ping Post (vendor availability pings). Choosing Ping Post adds a source scope: specific sources or all sources, so a vendor's key can only ping for their own traffic.
Then the key is shown once. Copy it immediately; careCycle stores only a hash, and a lost key means minting a new one.
Scoping and Rotation
Give each integration its own narrowly-scoped key: a read-only key for reporting, a ping-post key per vendor. Rotation is create-new, hand over, delete-old; revoking a key by deleting it cuts access immediately without touching anything else.
For the vendor-facing view of ping-post keys (what to send vendors, error behavior, source scoping), see the ping-post guide.