Authentication

All Nevatal API endpoints require authentication via API keys. Your API key identifies your clinic and determines the scope of data you can access.

Getting your API key

Log into your Nevatal dashboard at app.nevatal.com
Navigate to Settings → API Keys
Click Create API Key
Select the scopes (permissions) your integration needs
Copy and securely store the generated key

API keys are shown only once at creation time. Store them securely. If you lose a key, revoke it and create a new one.

Using your API key

Include the API key as a Bearer token in the Authorization header of every request:

curl -X GET https://api.nevatal.com/api/v1/patients \
  -H "Authorization: Bearer nvtl_your_api_key_here" \
  -H "Content-Type: application/json"

Scopes

API keys are scoped to specific modules. When creating a key, you select which modules it can access:

Scope	Read	Write	Description
`patients`	✅	✅	Patient records and demographics
`appointments`	✅	✅	Appointment scheduling and management
`billing`	✅	✅	Invoices, payments, and credit notes
`emr`	✅	✅	Medical records, prescriptions, clinical notes
`clinical-procedures`	✅	✅	Procedure catalog and management
`locations`	✅	❌	Clinic location information

Key management

Revoking a key

curl -X DELETE https://api.nevatal.com/api/v1/api-keys/{keyId} \
  -H "Authorization: Bearer nvtl_admin_key"

Listing active keys

curl -X GET https://api.nevatal.com/api/v1/api-keys \
  -H "Authorization: Bearer nvtl_admin_key"

Security best practices

Never expose keys in client-side code

API keys should only be used in server-to-server communication. Never include them in frontend JavaScript, mobile apps, or public repositories.

Use the minimum required scopes

Only grant the scopes your integration actually needs. A billing integration doesn’t need EMR access.

Rotate keys regularly

Create new keys periodically and revoke old ones. This limits the impact of a compromised key.

Use environment variables

Store API keys in environment variables or a secrets manager, never hardcoded in source files.

Introduction Quickstart

Getting Started

Core Concepts

Authentication

Authentication

Getting your API key

Using your API key

Scopes

Key management

Revoking a key

Listing active keys

Security best practices

​Authentication

​Getting your API key

​Using your API key

​Scopes

​Key management

​Revoking a key

​Listing active keys

​Security best practices

Authentication

Getting your API key

Using your API key

Scopes

Key management

Revoking a key

Listing active keys

Security best practices