Authentication

Using the Squire SDK requires having a valid access token. An access token can be requested from the Squire API using your Squire API key. If you do not have a Squire API key yet, create one via the Portal.

Authentication flow

The SDK uses token-based authentication to securely identify users per integration. It goes as follows:

Your EHR client requests an access token from your backend
Your EHR backend requests an access token from Squire API using your private API key
The Squire API validates the request and returns an access token
Your EHR backend provides the access token to your client application
Your EHR client initializes the Squire SDK using the access token

Requesting an access token

Request access tokens from your server. Never ship your API key to the client.

To request an access token, make a POST request to https://api.squire.eu/api/v1/external/token/ with your API key in the header and the user ID in the request body.

Request specification

Request an access token by calling the Squire API from your preferred programming language.

Header	Required	Description
`X-Api-Key`	Yes	Your Squire API key for authentication
`Content-Type`	Yes	Must be set to `application/json`

The request body is a JSON object with the following keys:

Parameter	Type	Required	Description
`user_id`	string	Yes	Unique identifier of the user in your system
`first_name`	string	Yes	First name of the user
`last_name`	string	Yes	Last name of the user
`organisation`	string	Yes	The name of the organisation (the practice, hospital, or similar) where the user works
`organisation_id`	string	No	Unique identifier of the organisation (practice or hospital department) in your system. Acts as the data scope: all users sharing the same `organisation_id` see the same intake configurations and session data.
`healthcare_provider_identification_number`	string	No	The healthcare provider identification number of the user (e.g. RIZIV number in Belgium). Separators between the numbers or characters are allowed.
`email`	string	No	Email address of the user in your system
`healthcare_provider_type`	string	No	The specific type of healthcare provider

Healthcare provider types

Name	id
Anesthesiologist	`anesthesiologist`
Cardiologist	`cardiologist`
Dermatologist	`dermatologist`
Dietitian	`dietitian`
Emergency Doctor	`emergency_doctor`
Endocrinologist	`endocrinologist`
Gastroenterologist	`gastroenterologist`
General Practitioner	`general_practitioner`
Geriatrician	`geriatrician`
Gynecologist	`gynecologist`
Hematologist	`hematologist`
Home Nurse	`home_nurse`
Hospital Nurse	`hospital_nurse`
Infectiologist	`infectiologist`
Medical Social Worker	`medical_social_worker`
Nephrologist	`nephrologist`
Neurologist	`neurologist`
Nursing Home Nurse	`nursing_home_nurse`
Oncologist	`oncologist`
Ophthalmologist	`ophthalmologist`
Orthopedic	`orthopedic`
Otorhinolaryngologist	`otorhinolaryngologist`
Pathologist	`pathologist`
Pediatrician	`pediatrician`
Physiotherapist	`physiotherapist`
Practice Nurse	`practice_nurse`
Psychiatrist	`psychiatrist`
Psychologist	`psychologist`
Pulmonologist	`pulmonologist`
Radiologist	`radiologist`
Rheumatologist	`rheumatologist`
Secretariat Staff	`secretariat_staff`
Speech-Language Pathologist	`speech_language_pathologist`
Stomatologist	`stomatologist`
Surgeon	`surgeon`
Urologist	`urologist`

Example request


curl -X POST "https://api.squire.eu/api/v1/external/token/" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "doctor123", "first_name": "doctor", "last_name": "123", "organisation": "practice_name", "healthcare_provider_identification_number": "12345678901", "email": "doctor@123.com", "healthcare_provider_type": "general_practitioner"}'

Response specification

A successful request returns an access token and its expiration date:


{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "expires_at": "2025-01-01T14:30:00Z"
}

Field	Type	Description
`token`	string	JWT access token for SDK initialization
`expires_at`	string	ISO 8601 formatted expiration timestamp

For examples in other languages and the full list of possible status codes, see the token endpoint API reference .

Next steps

Now that you have acquired a valid access token, continue with either SDK installation or the widget overview.