Authentication

All Integration API requests must be authenticated using an API key.

Getting Your API Key

1. Log in to your NeuralRev dashboard
2. Navigate to Settings > API Keys
3. Click Create API Key
4. Provide a descriptive name (e.g., "EMR Integration - Production")
5. Copy and store the key securely — it will not be shown again

API keys are prefixed with nrev_ for easy identification.

Using Your API Key

Include your API key in every request using one of two methods:

Option 1: x-api-key Header (Recommended)

curl -X POST https://api.neuralrev.ai/integration/patients \
  -H "x-api-key: nrev_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id": "PAT-001", "first_name": "Jane", "last_name": "Doe", "date_of_birth": "1990-01-15T00:00:00Z"}'

Option 2: Bearer Token

curl -X POST https://api.neuralrev.ai/integration/patients \
  -H "Authorization: Bearer nrev_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id": "PAT-001", "first_name": "Jane", "last_name": "Doe", "date_of_birth": "1990-01-15T00:00:00Z"}'

Key Scoping

Each API key is scoped to a single workspace. Data created via the API belongs to that workspace and is isolated from other workspaces. You cannot use a key from one workspace to access data in another.

Key Management

Security Best Practices

• Rotate keys regularly — Create a new key, update your integration, then delete the old key
• Use descriptive names — Name keys by environment and system (e.g., "Epic Prod", "Cerner Staging")
• One key per system — Use separate keys for each integration point
• Never expose in client code — API keys should only be used server-to-server
• Monitor usage — All API key activity is recorded in the audit trail
• Deactivate immediately if a key is compromised

Rate Limits

API key-authenticated requests are subject to the global rate limit:

When rate limited, the API returns HTTP 429 with a retryAfter field indicating seconds until you can retry.

Authentication Errors

Example Error Response

{
  "error": "Invalid API key",
  "statusCode": 401
}