Authentication and permissions

Use OAuth 2.0 Client Credentials from your server. Send POST /api/v1/oauth/token with grant_type=client_credentials and your assigned credentials. The endpoint accepts JSON or HTTP Basic for client authentication. Request the scope subset your operation needs.

curl --fail-with-body "${ELY_URL}/api/v1/oauth/token" \
  --user "${ELY_CLIENT_ID}" \
  -H "Content-Type: application/json" \
  --data '{"grant_type":"client_credentials","scope":"appointments.read"}'

Enter your client secret when curl prompts for a password. Use appointments.read if your assigned client has that scope.

Send the returned token as Authorization: Bearer <access-token>. Renew it using the returned expires_in. Each credential is bound to the assigned clinic. For integrations provisioned with an API key, send it in X-Elynext-API-Key.

Store credentials and tokens on your server. Schedule rotation or revocation with your onboarding contact. Rotation replaces the OAuth client secret immediately. At the agreed cutover, update your server configuration and verify that it can obtain a new token. If you use an API key, rotation also replaces the existing key, so update your configuration at cutover and verify an authorized request.