Authentication | Luna Health API

The Luna Health API is a read-only REST API: every documented endpoint uses the HTTP GET method. Each request must be authenticated with an API key so Luna Health can identify your integration and enforce access to the right clinic data.

Get an API key

Create a free account and generate a key from your account dashboard. Keys are tied to your organization and can be revoked at any time.

Authenticate a request

Send your API key with every request using the scheme shown in Security scheme below. The most common form is a bearer token in the Authorization header:

curl https://account.lunahealth.app/api/patients \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch("https://account.lunahealth.app/api/patients", {
  headers: { Authorization: "Bearer YOUR_API_KEY" },
});
const data = await res.json();

import requests

res = requests.get(
    "https://account.lunahealth.app/api/patients",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()

Replace YOUR_API_KEY with the key from your dashboard, and adjust the base URL and path to the endpoint you are calling — see the API reference for each endpoint.

Keep your key safe

Treat API keys like passwords. Never commit them to source control or expose them in client-side code.
Store keys in environment variables or a secrets manager, and load them at runtime.
Rotate keys periodically and revoke any key you believe has been exposed.

Troubleshooting

401 Unauthorized — the key is missing, malformed, or revoked. Confirm the header name and value against the security scheme below.
403 Forbidden — the key is valid but not authorized for that resource. Check the scopes granted to the key.