Send the key on every clinic request as Authorization: Bearer ovpm_… or X-API-Key. The clinic stores a bcrypt hash. A missing or revoked key returns 401. A key without the operation's scope returns 403.
The practice comes from the key. A practice id in the query or body is not a grant. A key with no practice returns 403 practice_unresolved.
Practice admins create and revoke keys in Settings → API Keys. Revocation applies on the next request. Rotation is create a new key, then revoke the old one. This API does not use OAuth.
The limit is 600 requests per minute per key. Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. Over the limit returns 429.
Browser cross-origin calls to /api/v1 are not supported. Call the API from your server. Do not put a production key in browser-side code or in this documentation site.