Skip to main content

​
Overview

All Shasta Health API requests are authenticated with an API key passed in the Authorization header. This guide walks through generating a key, storing it securely, and using it in your requests.

​
Generating an API key

  1. Log in to the Shasta provider portal.
  2. Navigate to Settings > API at app.shasta.health/provider/settings/api.
  3. Click Create API Key.
  4. Give the key a descriptive name (e.g. “Production Eligibility” or “Staging”).
  5. Copy the key immediately — it will only be shown once.
Your API key is displayed only at the time of creation. If you lose it, you will need to generate a new one.

​
Storing your API key securely

  • Never commit API keys to source control. Use environment variables or a secrets manager instead.
  • Store the key in an environment variable such as SHASTA_HEALTH_API_KEY.
  • In production, use a secrets manager like AWS Secrets Manager, Google Secret Manager, HashiCorp Vault, or your platform’s built-in secrets (e.g. Vercel Environment Variables).
  • Restrict access to the key to only the services and team members that need it.
  • Rotate keys periodically and revoke any that are no longer in use.

​
Using the API key

Pass your API key in the Authorization header with the Key prefix: 
Authorization: Key <your-api-key>

curl -X POST https://app.shasta.health/api/eligibility \
  -H "Authorization: Key $SHASTA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tradingPartnerServiceId": "60054",
    "provider": {
      "organizationName": "Shasta Medical Group",
      "npi": "1234567890"
    },
    "subscriber": {
      "firstName": "Jane",
      "lastName": "Doe",
      "dateOfBirth": "19800115",
      "memberId": "XYZ123456"
    }
  }'

​
Error responses

If the API key is missing or invalid, you will receive a 401 response: 
{
  "code": "UnauthorizedException",
  "message": "Unauthorized"
}
If the key is valid but does not have permission for the requested operation, you will receive a 403 response: 
{
  "code": "AccessDeniedException",
  "message": "Site is not configured for eligibility checks"
}

​
Next steps

Once you have your API key set up, follow the Eligibility Check Guide to submit your first eligibility check.