API Keys
Create API keys so a developer can connect your website to GEN Health, and keep your secret keys safe. No developer? Skip it.
API keys let your own website or app talk to GEN Health. You need them only if a developer is wiring your website into the platform.
Can you skip this? If you have no developer, you do not need API keys. Your patient portal and storefront work fully without them. Skip this page.
Before you start
Have these ready:
A developer who will use the keys
A password manager to share secret keys safely
Your payments connected, if you want real checkout (see the check below)
Who does what: You create the keys. You are the Client Admin. Your developer uses them on your website. Your provider network (the medical team that employs the doctors) and GEN Health support do not touch this.
Time: About 5 minutes to create a key. Your developer does the wiring after that.
How to create an API key
Open the Developers settings
In the left menu, click Settings. On the Settings page, click the Developers card. You land on the Developers area. You see four cards: API keys, Webhooks, Storefront, and Recent activity.
Open your API keys
Click Manage API keys. You see a table with these columns: Name, Key, Type, Created, Status, and Actions.
Create a new key
Click Create API key. Type a name that says what the key is for, like "Website checkout." Click Generate. A new row appears in the table.
Copy the key
In the new row, click Reveal, then Copy key. The key is now copied. Keep it safe for the next step.
Send it to your developer safely
Share the key with your developer through a password manager. Do not paste a secret key into email, chat, a ticket, or a shared document.
The Developers area also has a Hosted checkout & SDK quick link. Hosted checkout is a ready-made payment page GEN Health hosts, so patients can pay without a developer building one.
Demo mode blocks real payments. Hosted checkout and checkout links do not take real money while your account is in demo mode. Connect a real payment processor and turn demo mode off before you share a live link. Here's how to check: open Billing in the left menu. If your processor shows None (test mode), you are still in demo mode.
Two kinds of keys
Every key is one of two types. The difference is where you can keep each key.
| Type of key | Where you can keep it |
|---|---|
| Publishable storefront key (public) | Safe in your website's public code. A patient's browser is allowed to see it. |
| Secret key | Server-side only. Never in public website code, and never shared in plain text. |
Keep your keys safe
Share secret keys through a password manager, not email, chat, tickets, or shared files.
Write down which website or app uses each key. Then you can replace one key later without breaking the others.
Change your keys every few months, and whenever a developer or vendor leaves. Old keys stop working once you replace them.
Place a test order after you create or change a key, to confirm the connection still works.
A leaked secret key is dangerous. Anyone who has your secret key can act as your business. If a secret key may have been seen by someone else, make a new key right away. Stop using the old one.
Words to know
| Word | What it means |
|---|---|
| API key | A secret code that lets your website talk to GEN Health. For developers. |
| Publishable storefront key | A public code that lets your website show and sell your products. For developers. |
| Hosted checkout | A ready-made payment page GEN Health hosts, so you don't need a developer to take payment. |
| Demo mode | A practice mode. You can click around, but real payments and real checkout links do not work yet. |
| Webhook | An automatic message your website gets when something happens, like an order being placed. For developers. |
Common questions
We don't have developers. Do we need this?
No.
- API keys only matter when a developer wires your own website into the platform.
- Your patient portal and storefront work fully without them.
How do I tell a publishable key from a secret key?
Check where the key ends up.
- If it shows in a patient's browser, it is publishable.
- A secret key never leaves your servers. Keep it out of public website code, shared documents, and screenshots.
My checkout link will not take a real payment. Why?
Your account is probably in demo mode.
- Open Billing in the left menu and check your payment processor.
- If it shows None (test mode), connect a real processor to turn demo mode off.
- See the Connect Payments guide for the steps.
Should I make more than one key?
Yes, if you have more than one website or tool.
- Give each website or app its own key.
- Then you can replace one key later without breaking the others.
Related
Was this helpful?