User Accounts Guide - Self-service API credential management

​

Overview

​

What is self-service API credential management?

Elation provides a robust set of APIs that allow third-party applications to integrate with your practice’s clinical and administrative data. Previously, obtaining API credentials required contacting Elation Support and waiting for credentials to be issued manually. Self-service API credential management lets Practice Admins generate, manage, and revoke their own API credentials directly from practice settings — giving you immediate control over your integrations without needing to open a support ticket. You can create credentials for either Elation’s Standard API or the FHIR API, and assign fine-grained scopes to control exactly what data each set of credentials can access.

​

Who can use it?

Self-service API credential management is available to users with the Practice Admin role. Only Practice Admins can create, view, modify, or revoke API credentials. For more information about administrative privileges, see User Accounts Guide - Administrative privileges.

​

Workflow Instructions

​

Generating API credentials

1. Navigate to Settings > API Access.

2. Click + Create API Key. In the dialog that appears, enter a Name for the key and select the API type — either Elation APIv2 (Elation’s proprietary REST API) or FHIR (HL7 FHIR R4 API). The API type cannot be changed after creation.

3. Click Create. You will be shown your Client ID and Client Secret. Copy these values or click Download Credentials to save them to a file.

4. Check the I have saved my credentials securely checkbox, then click Done to return to the API Access page, or click Close and Edit Scopes to configure scopes immediately.

​

Managing existing credentials

1. Navigate to Settings > API Access. Your existing API keys are listed with their name, API type, Client ID, and creation date.
2. To edit the scopes for a key, click on the ‘Scopes’ button to open the scope editor.
3. To delete a key, click the trash icon next to the key.

​

Selecting scopes

When creating or editing API credentials, you will choose which scopes to assign. Scopes control what data the credentials are permitted to read or write. For a full explanation of how scopes work and the available scope options, see Token Scopes. In the Edit Scopes dialog, scopes are organized by API category (e.g., Billing API, Patient Profile API, Scheduling API). Expand each category to select individual scopes, or use the checkbox next to the category name to select all scopes within it. You can also click Set All to Read-Only to quickly restrict the key to read-only access across all categories. Click Save when you are done. Scope changes take effect immediately.

​

Revoking credentials

If you no longer need a set of credentials, or if you believe they may have been compromised, you can revoke them from the API Access page.

1. Navigate to Settings > API Access.
2. Click the trash icon next to the key you want to revoke.
3. A confirmation dialog will appear warning that this action cannot be undone. Click Delete to permanently revoke the credentials, or Cancel to go back.

​

Important Security Considerations

API credentials function like a username and password for your practice’s data. Anyone with access to your credentials can read and modify all of the data in your practice that the assigned scopes permit.

• Store credentials securely. Use a secrets manager or encrypted vault. Do not store credentials in plaintext, in email, or in shared documents.
• Do not share credentials through insecure channels such as email, chat, or sticky notes.
• Revoke credentials immediately if you suspect they have been compromised.
• Use the narrowest scopes possible when creating credentials to limit the impact of accidental exposure.

​

Frequently Asked Questions

​

Do I need to use self-service credentials, or can I still request them from Elation?

Self-service credential management is only available in the sandbox environment. If you need production credentials, please continue to contact Elation Support.

​

Can I change the scopes on existing credentials?

Yes. You can edit the scopes assigned to existing credentials at any time. Changes take effect immediately.

​

What happens if I revoke credentials that an integration is using?

That integration will immediately lose the ability to authenticate with Elation’s API. You will need to generate new credentials and update the integration’s configuration before it can reconnect.

​

I need to integrate with a specific vendor or lab. Should I use self-service credentials?

If you require integration with a named vendor or lab, please contact Elation Support for guidance. Some vendor integrations have specific requirements that may not be covered by self-service credentials.

​

Related Articles

• User Accounts Guide - Administrative privileges
• Getting Started (API)
• Token Scopes