API Keys

API keys allow you to connect external systems directly to your DailyStak account. If you or your development team want to build custom integrations — like syncing orders to your EHR, automating customer imports, or pulling reporting data into your own dashboards — API keys are how you authenticate those requests.

Treat API keys like passwords

Your API keys provide direct access to your DailyStak account data, including customer information, orders, and billing. Never share them in emails, chat messages, or public repositories. If you suspect a key has been compromised, revoke it immediately and generate a new one.

When Do You Need API Keys?

Most partners don't need API keys — the DailyStak portal and webhooks cover the majority of use cases. API keys are for when you want to:

• Pull data from DailyStak into another system (orders, customers, products)
• Push data into DailyStak programmatically (bulk customer imports, automated order creation)
• Build custom integrations with your EHR, practice management software, or internal tools
• Automate workflows beyond what webhooks and Zapier can handle

If you just want to receive notifications when events happen, webhooks are a simpler option that doesn't require API keys.

Generating API Keys

Only team members with the Admin role can create and manage API keys.

1. Go to Settings in the left sidebar
2. Click the API Keys tab
3. Click Generate New Key
4. Give the key a descriptive name (e.g., "EHR Integration — Production")
5. Select the permissions the key needs:

Permission	What it allows
order.read	View orders and order details
order.write	Create and update orders
product.read	Browse the product catalog
subscription.read	View subscriptions
subscription.write	Create and manage subscriptions
customer.read	View customer records
customer.write	Create and update customers

6. Click Generate

You'll receive two values:

• Client ID — identifies your integration (safe to store in configuration)
• Client Secret — the private key used to authenticate (shown only once)

Copy your Client Secret immediately

The Client Secret is displayed only once when the key is generated. Copy it and store it somewhere secure (a password manager, a secrets vault, or an encrypted configuration file). If you lose it, you'll need to revoke the key and generate a new one.

Using Your API Keys

Your API keys authenticate requests to the DailyStak Partner API. Full API documentation, including all available endpoints, request formats, and response examples, is available at:

docs.fulfillment.juniperhealth.com

Authentication Flow

1. Use your Client ID and Client Secret to request an access token
2. Include the access token in the Authorization header of every API request

Authorization: Bearer <your_access_token>

Access tokens expire after a set period. When a token expires, request a new one using your Client ID and Client Secret. The full authentication flow is documented in the API reference.

Security Best Practices

Your API keys can read and modify real patient and order data. Follow these practices to keep your account secure:

Do

• Use the minimum permissions needed. If your integration only reads order data, don't grant write access.
• Store secrets in a secure location — a password manager, environment variables, or a secrets vault (like AWS Secrets Manager or HashiCorp Vault). Never hardcode them in source code.
• Use separate keys for each integration. If one is compromised, you can revoke it without affecting others.
• Name your keys descriptively so you know what each one is used for.
• Rotate keys periodically — revoke old keys and generate new ones on a regular schedule.
• Audit your active keys regularly and revoke any that are no longer in use.

Don't

• Don't share keys via email, Slack, or text messages. Use a secure sharing method like a password manager's sharing feature.
• Don't commit keys to version control (Git, GitHub, etc.). Use environment variables or a .env file that's excluded from your repository.
• Don't use production keys for testing. Generate a separate key with limited permissions for development and testing.
• Don't give keys to people who don't need them. API access should be limited to team members or vendors who require it.

Managing Your Keys

Viewing Active Keys

Go to Settings > API Keys to see all active keys, including:

• Key name and Client ID
• Permissions granted
• When it was created
• When it was last used

The Client Secret is never shown after initial generation.

Revoking a Key

If a key is no longer needed or may have been compromised:

1. Go to Settings > API Keys
2. Find the key and click Revoke
3. Confirm the revocation

Revocation is immediate and permanent

Any integration using that key will immediately stop working. Make sure you've updated your integration with a new key before revoking the old one, unless you're responding to a security concern.

Rotating a Key

To rotate a key without downtime:

1. Generate a new key with the same permissions
2. Update your integration to use the new Client ID and Client Secret
3. Verify the integration works with the new key
4. Revoke the old key

Troubleshooting

My API requests are returning "Unauthorized"

• Verify you're using the correct Client ID and Client Secret
• Check that your access token hasn't expired — request a new one
• Make sure the key has the required permissions for the endpoint you're calling

I lost my Client Secret

Client Secrets are only shown once at generation time. You'll need to:

1. Generate a new key with the same permissions
2. Update your integration with the new credentials
3. Revoke the old key

I think my key has been compromised

1. Revoke the key immediately in Settings > API Keys
2. Generate a new key and update your integration
3. Review recent activity in the portal to check for unauthorized actions
4. Contact DailyStak support if you see suspicious activity