Skip to main content
POST
curl

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-Brand-Slug
enum<string>
default:hi-doctor

Send X-Brand-Slug: hi-doctor. Public auth/questionnaire/attribution routes resolve the brand header; authenticated scope also uses the live user brand. Do not claim the header is universally server-required: default-brand fallback exists.

Available options:
hi-doctor

Body

application/json

Email and password sign-in for the patient app.

An account created with Google sign-in has no password. A password sign-in for such an account returns code: "google_account", so the client can offer "Continue with Google" instead of a generic invalid-credentials message.

email
string
required
write-only

Account email address.

password
string
required
write-only

Account password; write-only secret.

Response

Successful create an access token pair.

Token pair returned by sign-in, with the role flags the web app uses for routing. All three are false on a patient account and none of them grants access to anything in this reference.

refresh
string
required

Refresh token.

access
string
required

Access token — send as Authorization: Bearer.

capabilities
string[]

Capabilities granted to this authenticated account.