> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rxnote.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys: personal or organization, scopes, test and live.

Every request carries an API key as a bearer token:

```bash theme={null}
Authorization: Bearer rxn_live_...
```

Keys are server-side secrets. Never put one in a browser, a mobile app or a public repository.

## Two kinds of key

> **Personal key**
>
> Created by any clinician under **Settings → API**. It acts only as that clinician: patients and visits are
> theirs, with their templates and preferences. For a clinician's own tools and scripts.

> **Organization key**
>
> Created by an organization admin under **Organization → API**, for a system many clinicians use — a clinic
> management system or HIS. **Every patient and visit names its clinician** with `clinician_email`.

With an organization key, the clinician must be a member of the organization with an RxNote account. If they are
not, the request fails with `422 CLINICIAN_NOT_FOUND` — invite them to the organization first. The visit is that
clinician's, and they review it in RxNote under their own login.

Usage, limits and webhooks belong to the **account**: the organization, or the clinician when they have none.

## Scopes

| Scope | Allows |
| - | - |
| `patients:write` | Create patients |
| `patients:read` | Read and search patients |
| `visits:write` | Create visits and process recordings |
| `visits:read` | Read visits |
| `templates:read` | List templates |

Give each key only what it needs. A request without the scope fails with `403 SCOPE_MISSING`.

## Test and live

Keys made on the sandbox (`dev.rxnote.ai`) or locally start `rxn_test_` and never work on production; production keys start
`rxn_live_`. Use synthetic patients only in the sandbox.

## Rotating and revoking

Create the new key, deploy it, then revoke the old one in settings. A revoked key stops working within 30 seconds
everywhere. Keys can also be given an expiry date when created. The secret is shown only once; RxNote stores a hash
and cannot show it again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.