Authentication

The Rehabify Partner API authenticates every request with a secret API key. Your key also decides which environment a request runs in.

API keys and environments

Both environments use the same base URL, https://api.physioaroundme.com/v1. Every response includes an X-Rehabify-Environment header (sandbox or live), and every referral has an environment field, so you can always tell which environment you're in.

Data never crosses environments. A sandbox key can't see live referrals, and a live key can't see sandbox referrals.

Creating keys

Create keys in the Partner Portal under Developers → API keys. A key is the prefix followed by 40 alphanumeric characters, for example sk_test_ + 40 characters.

• Shown once. The full key is displayed only when you create it. Rehabify stores only a hash, so we can't show it again or recover it. If you lose a key, create a new one and revoke the old one.
• Multiple named keys. You can have up to 10 active keys in each environment, for example one per service or per deployment. Give each key a descriptive name.
• Instant revocation. Revoking a key takes effect immediately. Any further request with it fails with 401 invalid_api_key.
• No shared keys. There are no public or shared sandbox keys. Every key belongs to your organisation.

Authenticating requests

Send the key as a bearer token:

Authorization: Bearer sk_test_xxx

If your HTTP client can't set an Authorization header, send the key in X-API-Key instead:

X-API-Key: sk_test_xxx

curl "https://api.physioaroundme.com/v1/partners/referrals?limit=1" \
  -H "Authorization: Bearer $REHABIFY_API_KEY"

Keep keys server-side

• Load keys from environment variables or a secret manager. Don't hard-code them.
• Don't log keys or full Authorization headers. Log the X-Request-Id response header instead.
• Use separate keys for separate services, so you can revoke one without touching the others.

The only endpoint you can call from a browser is the public, unauthenticated lead capture endpoint used by no-code referral link forms. It needs no key.

Rotating and revoking keys

Because you can hold several keys at once, you can rotate without downtime:

1. Create a new key in Developers → API keys.
2. Deploy it to your servers.
3. Confirm that traffic is flowing with the new key.
4. Revoke the old key. Revocation is immediate.

If a key may have leaked, revoke it straight away and create a replacement.

Webhook signing secrets are separate from API keys. Each environment has its own secret (whsec_ followed by 40 alphanumeric characters), which you can reveal on demand or rotate in Developers → Webhooks. See Webhooks.

Production access (going live)

Live keys are available only after Rehabify approves your organisation for production.

1. Apply in the Partner Portal. Once Rehabify approves your organisation, you get sandbox access: test keys and sandbox webhooks.
2. Build and test against the sandbox.
3. Request production access in the portal. This opens the go-live checklist. Our Go-live checklist explains each item.
4. Rehabify reviews and approves your request. You can then create sk_live_ keys and set your live webhook endpoint.

You can't create live keys before approval. If your production access is later suspended, live keys stop working and requests fail with 403 production_access_required.

Authentication errors

Not available yet

These features don't exist today. Don't build against them.