Authenticate API requests
The GenHealth API accepts GenHealth API keys and supported JWTs through the HTTP bearer authorization scheme.
Choose a credential
Use the credential type provisioned for your integration. API keys are intended for server-to-server requests. Supported JWTs are validated for issuer, audience, expiration, and GenHealth access before a request is authorized.
| Credential | Best for | Storage |
|---|---|---|
| GenHealth API key | Server-to-server integrations | Encrypted server-side secret storage |
| Supported JWT | Short-lived delegated access | Your existing secure token lifecycle |
Bearer tokens
Include the credential in the Authorization header of every request. GenHealth resolves the organization and permitted operations from the token.
Authorization: Bearer <YOUR_API_KEY>Permissions and organization access
The read endpoints in this preview require API read access. Every request is scoped to the organization resolved from the credential, so a valid resource ID from another organization is not sufficient to grant access.
Token security
- Keep credentials on the server and outside browser bundles.
- Store secrets in an encrypted environment or secret manager, not in source control.
- Rotate a credential immediately if it may have been exposed.
- Use separate credentials for development and production environments.
Troubleshoot authentication errors
| Symptom | Likely cause | Next check |
|---|---|---|
| 401 Unauthorized | Missing, expired, or invalid credential | Authorization header format and credential status |
| 403 Forbidden | Credential lacks access to the operation | Assigned API permissions and organization |
| 404 Not Found | Resource is unavailable in the resolved organization | Resource ID and environment |