Quickstart — Authentication

Three credential paths cover every integration. Pick the one that matches your application.

Option 1 — End-user (session JWT)

End-user sign-in uses your tenant’s managed identity provider. After sign-in, the session JWT is automatically attached to every request the frontend makes.

import { useAuth } from '@clerk/clerk-react'; function MyComponent { const { getToken } = useAuth; async function listPatients { const token = await getToken; const res = await fetch('https://api.medera.info/api/patients', { headers: { Authorization: `Bearer ${token}` }, }); return res.json; } } 

import { auth } from '@clerk/nextjs/server'; export default async function Page { const { getToken } = await auth; const token = await getToken; const res = await fetch('https://api.medera.info/api/patients', { headers: { Authorization: `Bearer ${token}` }, }); return <pre>{JSON.stringify(await res.json, null, 2)}</pre>; } 

Option 2 — Server-to-server (Developer API Key)

For backend integrations and batch jobs, use a Developer API Key created in the Console under Settings → Developer API Keys.

cURL curl https://api.medera.info/api/agent-workflows \ -H "X-API-Key: $MEDERA_API_KEY" 

import { MederaClient } from '@medera/sdk'; const client = new MederaClient({ apiKey: process.env.MEDERA_API_KEY!, }); const workflows = await client.workflows.list; 

from medera import MederaClient import os client = MederaClient(api_key=os.environ["MEDERA_API_KEY"]) workflows = client.workflows.list 

Option 3 — Internal service-to-service

The AI Services (internal service) and backend (internal service) communicate using a tenant-scoped X-Service-Key header. This is for internal use; do not expose to clients.

SDK token refresh

The SDKs automatically refresh tokens before expiration. There is no need to track expiry manually.

// Token is refreshed automatically const session = await client.sessions.get('ses_abc'); 

# Token is refreshed automatically session = client.sessions.get('ses_abc')

What’s next

Creating Clients

Generate your first API key.

Security Best Practices

Five rules to follow.

​Option 1 — End-user (session JWT)

​Option 2 — Server-to-server (Developer API Key)

​Option 3 — Internal service-to-service

​SDK token refresh

​What’s next