Authentication

Access tokens

Homecare Pro issues each connected system its own credentials. Send your access token as a bearer token on every request:

Authorization: Bearer YOUR_ACCESS_TOKEN

Keep your token secret: store it server-side and never send it to a browser or mobile app. If you think a token has been exposed, contact Homecare Pro to revoke it and issue a new one.

A request with a missing, invalid or expired token returns 401 Unauthorized.

Choosing an agency

One token covers every agency associated with your connected system: the agencies you created, and any existing Homecare Pro agencies we've linked to you. All requests must specify their agency ID by providing the X-Agency-Id header, except listing and creating agencies:

X-Agency-Id: 861d8719-9bf2-45fb-81ba-f1e66d935f6c

A request only ever reads or changes the agency it names. To work across several agencies, make one request per agency.

Two requests don't take the header, because they work across your agencies:

Request	What it does
`GET /api/agencies`	Lists the agencies associated with your connected system.
`POST /api/agencies`	Creates an agency and associates it with your connected system.

Every other request requires it.

Situation	Response
The header is missing	`400 Bad Request`
The agency isn't associated with your connected system	`404 Not Found`
The record belongs to a different agency from the one in the header	`404 Not Found`

We return 404 rather than 403 so that a response never reveals whether another agency or its records exist.

Following links

Links in responses don't carry your credentials or the agency. When you follow one, send the same Authorization and X-Agency-Id headers you'd send for any other request.