Authentication

The Shepherd API authenticates with two API keys plus a clinic identifier, all sent as request headers on every call. There is no OAuth flow and no Bearer token. This page orients you; the full authentication reference has the header table, key rotation, the per-clinic scope model, and a working “hello world” in all five supported languages.

How you get keys

It depends who you are:

• Clinic accounts building on their own data self-serve keys from inside Shepherd (Admin → Integrations), once the open API feature is enabled. Don’t see the option? Ask your account manager to turn it on.
• Integration partners building for other clinics get keys from the Shepherd product team during onboarding: sandbox credentials first, then production once your integration is reviewed and a clinic agrees to enable it.

Either way, read keys from environment variables or a secrets manager; never hard-code them or ship them in mobile or browser code. If a key is exposed, your account manager can rotate it.

Note

Open API access is a paid add-on, $35 per site / month, billed to the practice that enables it. Reading the docs is free; the fee applies once the feature is on. See Pricing & access.

X-Clinic-Id is a header, not a body field

The most common first-integration error is leaving out the clinic id. It is a request header, like your two keys; a clinicId in the JSON body is ignored and the call still fails with 401 Missing X-Clinic-Id header. Set the header on every clinic-scoped request. See Errors for the full list of failure states.

Next

• Authentication reference: the header table, rotation, the per-clinic scope model, and a five-language “hello world”.
• Integration onboarding: the partner journey, start to finish.
• First integration tutorial: pull today’s appointments end to end.