Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.medera.info/llms.txt

Use this file to discover all available pages before exploring further.

Medera supports three credential types, each scoped to a tenant (organization) and an environment.
CredentialUse caseIssued byHeader
Clerk JWTEnd-user requests (clinician, admin)ClerkAuthorization: Bearer <jwt>
Developer API KeyServer-to-server, scoped to a projectMedera ConsoleX-API-Key: <key> (or Bearer)
Internal service keyAI service ↔ backend proxy authConsole (admin-only)X-Service-Key: <key>
Every PHI-touching request is validated through a four-layer defense:
  1. Authentication — authenticateToken (Clerk JWT) or authenticateApiKey (Developer API Key)
  2. Tenant context — setTenantContext injects organization_id into the PostgreSQL session via app.current_organization_id
  3. PHI audit logging — phiAuditMiddleware writes a hash-chained event per HIPAA §164.312(b)
  4. Purpose-based access — purposeBasedAccess(resource, ...purposes) restricts the request to the allowed purposes: TREATMENT, PAYMENT, OPERATIONS, EMERGENCY

​
Subscription gating

For agent / intake / therapy / copilot endpoints, the middleware stack also runs requireActiveSubscription and checkAgentLimit against the tenant’s Stripe subscription state.

​
Rate limits

Endpoint familyProductionDev / staging
Read endpoints100 req / min10,000 req / min
Write endpoints20 req / min10,000 req / min
Auth (/login, /register, /forgot-password)10 req / 15 min10 req / 15 min
/api/intake/start-batch-call10 req / min10 req / min

​
What’s next

Quickstart

Exchange credentials for a token.

Creating clients

Generate developer API keys.

Environments & Tenants

Sandbox, staging, production.

Security Best Practices

Keep credentials safe.